pkg/waveai/googlebackend.go (2)

38-45: Add sane HTTP transport timeouts when configuring a custom proxy client.

The custom client currently lacks dial/TLS timeouts, which can hang connections on network issues. Keep stream-friendly semantics by avoiding a client-wide Timeout, but set transport-level timeouts.

Apply this diff and add imports for net and time:

+  // Optional: tighten transport timeouts while preserving streaming behavior.
+  // Requires: import "net" and "time".
   transport := &http.Transport{
-    Proxy: http.ProxyURL(proxyURL),
+    Proxy: http.ProxyURL(proxyURL),
+    TLSHandshakeTimeout: 10 * time.Second,
+    ExpectContinueTimeout: 1 * time.Second,
+    IdleConnTimeout: 90 * time.Second,
+    DialContext: (&net.Dialer{
+      Timeout:   10 * time.Second,
+      KeepAlive: 30 * time.Second,
+    }).DialContext,
   }
   httpClient := &http.Client{
     Transport: transport,
   }

---

109-117: Defensive nil checks when flattening candidates.

Some SDK responses can include nil candidates or nil Content; skip safely.

Apply this diff:

 func convertCandidatesToText(candidates []*genai.Candidate) string {
   var rtn string
   for _, c := range candidates {
-    for _, p := range c.Content.Parts {
+    if c == nil || c.Content == nil {
+      continue
+    }
+    for _, p := range c.Content.Parts {
       rtn += fmt.Sprintf("%v", p)
     }
   }
   return rtn
 }

go.mod (1)

26-26: Consider using the sashabaranov/go-openai library consistently

The module adds both github.com/openai/openai-go/v2 (line 26) and already has github.com/sashabaranov/go-openai (line 27). Having two different OpenAI client libraries in the same project could lead to confusion and maintenance overhead.

Consider standardizing on one OpenAI client library throughout the codebase. The sashabaranov library appears to already be in use and supports streaming, so you might not need the additional openai-go/v2 dependency unless it provides specific features you require.

aiprompts/aisdk-streaming.md (1)

82-82: Format URLs properly in examples

The bare URLs in the examples should be wrapped in backticks or formatted as proper Markdown links for better readability.

-data: {"type":"source-url","sourceId":"https://example.com","url":"https://example.com"}
+data: {"type":"source-url","sourceId":"https://example.com","url":"https://example.com"}

The same applies to lines 90 and 98.

Also applies to: 90-90, 98-98

aiprompts/usechat-backend-design.md (1)

10-16: Add language specifiers to fenced code blocks

Several code blocks are missing language specifiers, which affects syntax highlighting and readability.

For example, line 10 should be:

-```
+```text

Or use appropriate language identifiers like http for endpoint definitions and text for plain text blocks.

Also applies to: 19-25, 32-34, 37-39, 145-150, 153-163, 173-176, 439-442, 445-449

pkg/waveai/ssehandlerch.go (2)

129-130: Consider making keepalive interval configurable

The keepalive ticker is hardcoded to 1 second. Some proxies or clients might need different intervals.

Consider adding a configurable keepalive interval:

+type SSEHandlerOptions struct {
+    KeepaliveInterval time.Duration
+}
+
-func MakeSSEHandlerCh(w http.ResponseWriter, ctx context.Context) *SSEHandlerCh {
+func MakeSSEHandlerCh(w http.ResponseWriter, ctx context.Context, opts *SSEHandlerOptions) *SSEHandlerCh {
+    if opts == nil {
+        opts = &SSEHandlerOptions{
+            KeepaliveInterval: SSEKeepaliveInterval,
+        }
+    }

---

235-242: Consider non-blocking writes to prevent deadlock

The WriteData method could block if the write channel is full and the context isn't done. This uses a default case that returns an error, but in high-throughput scenarios, you might want to consider a more graceful degradation.

Consider implementing a timeout or exponential backoff for writes:

 select {
 case h.writeCh <- SSEMessage{Type: SSEMsgData, Data: data}:
     return nil
 case <-h.ctx.Done():
     return h.ctx.Err()
-default:
-    return fmt.Errorf("write channel is full")
+case <-time.After(100 * time.Millisecond):
+    return fmt.Errorf("write timeout: channel is full")
 }

pkg/waveai/usechat-openai-responses.go (2)

19-80: Consider adding validation for empty input items list.

The function correctly handles message conversion and empty content filtering, but it doesn't validate whether the resulting inputItems list is empty after filtering. This could lead to an API error if all messages are filtered out.

Add validation after filtering:

 	// Convert messages to input items, filtering out empty content
 	var inputItems []responses.ResponseInputItemUnionParam
 	for _, msg := range messages {
 		content := msg.GetContent()
 		// Skip messages with empty content as OpenAI requires non-empty content
 		if strings.TrimSpace(content) == "" {
 			continue
 		}
 
 		// Convert role to EasyInputMessageRole
 		var role responses.EasyInputMessageRole
 		switch msg.Role {
 		case "user":
 			role = responses.EasyInputMessageRoleUser
 		case "assistant":
 			role = responses.EasyInputMessageRoleAssistant
 		case "system":
 			role = responses.EasyInputMessageRoleSystem
 		default:
 			role = responses.EasyInputMessageRoleUser
 		}
 
 		inputItems = append(inputItems, responses.ResponseInputItemParamOfMessage(content, role))
 	}
+
+	// Ensure we have at least one input item
+	if len(inputItems) == 0 {
+		inputItems = append(inputItems, responses.ResponseInputItemParamOfMessage("Hello", responses.EasyInputMessageRoleUser))
+	}

---

176-194: Redundant cleanup code in response.completed handler.

The cleanup code for ending reasoning and text streams is duplicated in the response.completed handler (lines 176-185) when it's already handled by the response.output_item.done event. This could lead to duplicate end events being sent.

Consider removing the redundant cleanup since response.output_item.done should have already handled it:

 		case "response.completed":
 			responseDone := event.AsResponseCompleted()
 			if !finished {
 				usage := &OpenAIUsageResponse{}
 				responseUsage := responseDone.Response.Usage
 				usage.PromptTokens = int(responseUsage.InputTokens)
 				usage.CompletionTokens = int(responseUsage.OutputTokens)
 				usage.TotalTokens = usage.PromptTokens + usage.CompletionTokens
 
-				// End reasoning if it was started but not ended
-				if reasoningStarted && !reasoningEnded {
-					sseHandler.AiMsgReasoningEnd(reasoningId)
-					reasoningEnded = true
-				}
-				// End text if it was started but not ended
-				if textStarted && !textEnded {
-					sseHandler.AiMsgTextEnd(textId)
-					textEnded = true
-				}
-
 				finishReason := "stop"
 				if responseDone.Response.Status == "completed" {
 					finishReason = "stop"
 				}
 
 				sseHandler.AiMsgFinish(finishReason, usage)
 				finished = true
 			}
 			return

aiprompts/anthropic-streaming.md (1)

373-476: Fix inconsistent budget_tokens value in thinking example.

The shell example uses "budget_tokens": 16000 (line 390) while the Python example uses "budget_tokens": 16000 (line 411). These are consistent, but the response shows a much smaller thinking output than would be expected with a 16000 token budget.

Consider updating the example to show a more realistic budget_tokens value or expanding the response to better demonstrate the thinking process with the allocated budget.

cmd/testai/main-testai.go (1)

60-89: Add error handling for missing schema properties.

The getToolDefinitions function assumes the schema structure exists but doesn't validate if the "config" key is present in the unmarshaled schema.

Add validation for the config schema:

 	configSchema := schemas["config"]
+	if configSchema == nil {
+		fmt.Printf("Warning: 'config' schema not found in testschema.json\n")
+		configSchema = map[string]interface{}{
+			"type": "object",
+		}
+	}

pkg/web/web.go (1)

476-494: Consider extracting CORS configuration to constants.

The CORS configuration in dev mode is hardcoded inline. Consider extracting these values to constants for better maintainability.

Extract CORS configuration to constants:

+const (
+	DevCORSMethods = "GET, POST, PUT, DELETE, OPTIONS"
+	DevCORSHeaders = "Content-Type, X-Session-Id, X-AuthKey, Authorization, X-Requested-With, Accept, x-vercel-ai-ui-message-stream"
+	DevCORSExposeHeaders = "X-ZoneFileInfo, Content-Length, Content-Type, x-vercel-ai-ui-message-stream"
+)
+
 	if wavebase.IsDevMode() {
 		originalHandler := handler
 		handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			origin := r.Header.Get("Origin")
 			if origin != "" {
 				w.Header().Set("Access-Control-Allow-Origin", origin)
 			}
-			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
-			w.Header().Set("Access-Control-Allow-Headers", "Content-Type, X-Session-Id, X-AuthKey, Authorization, X-Requested-With, Accept, x-vercel-ai-ui-message-stream")
-			w.Header().Set("Access-Control-Expose-Headers", "X-ZoneFileInfo, Content-Length, Content-Type, x-vercel-ai-ui-message-stream")
+			w.Header().Set("Access-Control-Allow-Methods", DevCORSMethods)
+			w.Header().Set("Access-Control-Allow-Headers", DevCORSHeaders)
+			w.Header().Set("Access-Control-Expose-Headers", DevCORSExposeHeaders)
 			w.Header().Set("Access-Control-Allow-Credentials", "true")

pkg/waveai/usechat-openai-completions.go (1)

41-90: Consider adding validation for empty chatMessages list.

Similar to the Responses API implementation, this function should validate that chatMessages is not empty after filtering.

Add validation after filtering:

 		}
 	}
+
+	// Ensure we have at least one message
+	if len(chatMessages) == 0 {
+		chatMessages = append(chatMessages, openai.UserMessage("Hello"))
+	}
 
 	// Create request using Chat Completions API

pkg/waveai/usechat.go (6)

91-95: Simplify error handling for JSON unmarshaling.

The current error handling pattern silently ignores unmarshaling errors. Consider logging or handling the error more explicitly rather than setting to nil.

-		presetAiSettings = &wconfig.AiSettingsType{}
-		if err := json.Unmarshal(mustMarshal(preset), presetAiSettings); err == nil {
-			// Successfully unmarshaled preset
-		} else {
-			presetAiSettings = nil
-		}
+		presetAiSettings = &wconfig.AiSettingsType{}
+		if err := json.Unmarshal(mustMarshal(preset), presetAiSettings); err != nil {
+			// Log the error for debugging purposes
+			log.Printf("Failed to unmarshal preset %s: %v", presetKey, err)
+			presetAiSettings = nil
+		}

---

102-106: Apply consistent error handling pattern for block metadata unmarshaling.

Similar to the preset unmarshaling above, this should follow the same error handling pattern.

-	blockAiSettings = &wconfig.AiSettingsType{}
-	if err := json.Unmarshal(mustMarshal(block.Meta), blockAiSettings); err != nil {
-		blockAiSettings = nil
-	}
+	blockAiSettings = &wconfig.AiSettingsType{}
+	if err := json.Unmarshal(mustMarshal(block.Meta), blockAiSettings); err != nil {
+		// Log the error for debugging purposes
+		log.Printf("Failed to unmarshal block metadata for block %s: %v", blockId, err)
+		blockAiSettings = nil
+	}

---

125-127: Consider making the default model configurable or using a constant.

The hardcoded model "gpt-4.1" might not be available or appropriate for all users. Consider making this configurable or at least defining it as a constant.

Define a constant at the package level:

const DefaultAIModel = "gpt-4o-mini"

Then use it here:

-	if aiOpts.Model == "" {
-		aiOpts.Model = "gpt-4.1"
-	}
+	if aiOpts.Model == "" {
+		aiOpts.Model = DefaultAIModel
+	}

---

167-169: Potential null pointer dereference in generateID.

The function doesn't check the error from rand.Read. While extremely unlikely to fail, it's good practice to handle it.

 func generateID() string {
 	bytes := make([]byte, 16)
-	rand.Read(bytes)
+	if _, err := rand.Read(bytes); err != nil {
+		// Fallback to a timestamp-based ID if random generation fails
+		return fmt.Sprintf("%d", time.Now().UnixNano())
+	}
 	return hex.EncodeToString(bytes)
 }

Add the import at the top:

import (
	...
	"time"
	...
)

---

210-213: Improve API type validation logic.

The current condition is confusing with the double negative. Consider restructuring for clarity and maintainability.

-	// Support OpenAI and Anthropic
-	if aiOpts.APIType != APIType_OpenAI && aiOpts.APIType != APIType_Anthropic && aiOpts.APIType != "" {
-		http.Error(w, fmt.Sprintf("Unsupported API type: %s (only OpenAI and Anthropic supported)", aiOpts.APIType), http.StatusBadRequest)
-		return
-	}
+	// Validate API type - support OpenAI and Anthropic
+	switch aiOpts.APIType {
+	case APIType_OpenAI, APIType_Anthropic, "":
+		// Valid API types (empty defaults to OpenAI)
+	default:
+		http.Error(w, fmt.Sprintf("Unsupported API type: %s (only OpenAI and Anthropic supported)", aiOpts.APIType), http.StatusBadRequest)
+		return
+	}

---

231-234: Unify streaming error handling across providers.

StreamAnthropicResponses returns (*StopReason, error) (pkg/waveai/usechat-anthropic.go) and its error is checked/logged at pkg/waveai/usechat.go:229–236, while OpenAI streamers (pkg/waveai/usechat-openai-completions.go / pkg/waveai/usechat-openai-responses.go) return no error. Choose one consistent approach: either make the OpenAI stream functions return (*StopReason, error) and propagate/handle errors in pkg/waveai/usechat.go, or have pkg/waveai/usechat.go treat Anthropic the same as OpenAI (ignore/handle the returned error consistently); ensure SSE error events are emitted uniformly.

pkg/waveai/usechat-anthropic.go (5)

1-10: Clean up documentation comments.

The comments contain reference markers (:contentReference[oaicite:X]{index=X}) that appear to be from an internal documentation system. These should be removed or replaced with actual references for clarity.

-// Package anthropicadapter streams Anthropic Messages API events and adapts them
-// to our AI‑SDK style SSE parts. Mapping is based on the AI‑SDK data stream
-// protocol (start/text-start/text-delta/text-end, reasoning-*, tool-input-*, finish, finish-step) :contentReference[oaicite:0]{index=0}
-// and Anthropic's Messages + Streaming event schemas (message_start,
-// content_block_start/delta/stop, message_delta, message_stop, error). :contentReference[oaicite:1]{index=1} :contentReference[oaicite:2]{index=2}
-//
-// NOTE: The public signature in api.txt references wshrpc.WaveAIOptsType;
-// for this self-contained package we define WaveAIOptsType locally with the
-// same shape. Adapt the import/alias as needed in your codebase. :contentReference[oaicite:3]{index=3}
+// Package waveai contains the Anthropic streaming adapter that converts Anthropic Messages API events 
+// to AI-SDK style SSE parts. Mapping is based on the AI-SDK data stream
+// protocol (start/text-start/text-delta/text-end, reasoning-*, tool-input-*, finish, finish-step)
+// and Anthropic's Messages + Streaming event schemas (message_start,
+// content_block_start/delta/stop, message_delta, message_stop, error).

---

308-309: Consider making buffer sizes configurable.

The hardcoded buffer sizes (64KB initial, 8MB max) might not be suitable for all use cases. Consider making these configurable or at least defining them as constants.

+const (
+	// SSE scanner buffer sizes
+	sseInitialBufferSize = 64 * 1024     // 64KB
+	sseMaxBufferSize     = 8 * 1024 * 1024 // 8MB
+)

 	// Stream decoding state
 	scanner := bufio.NewScanner(resp.Body)
-	scanner.Buffer(make([]byte, 64*1024), 8*1024*1024) // allow large lines
+	scanner.Buffer(make([]byte, sseInitialBufferSize), sseMaxBufferSize)

---

342-355: Simplify nested condition logic.

The nested if-else structure for handling event results is complex. Consider simplifying for better readability.

-			if curEvent != "" {
-				if stop, ret, rerr := handleAnthropicEvent(curEvent, dataBuf.String(), sse, blockMap, &toolCalls, &msgID, &model, finalStop); rerr != nil {
-					// Anthropic sent error event or malformed JSON.
-					return stop, rerr
-				} else if ret != nil {
-					// message_stop triggered return
-					return ret, nil
-				} else {
-					// maybe updated final stop reason (from message_delta)
-					if stop != nil && stop.RawReason != "" {
-						finalStop = stop.RawReason
-					}
-				}
-			}
+			if curEvent != "" {
+				stop, ret, rerr := handleAnthropicEvent(curEvent, dataBuf.String(), sse, blockMap, &toolCalls, &msgID, &model, finalStop)
+				
+				if rerr != nil {
+					// Anthropic sent error event or malformed JSON.
+					return stop, rerr
+				}
+				
+				if ret != nil {
+					// message_stop triggered return
+					return ret, nil
+				}
+				
+				// maybe updated final stop reason (from message_delta)
+				if stop != nil && stop.RawReason != "" {
+					finalStop = stop.RawReason
+				}
+			}

---

641-645: Simplify empty content handling.

The condition checking and reassigning empty content is redundant.

 		} else {
 			// Shorthand: string becomes a single text block. :contentReference[oaicite:25]{index=25}
-			if m.Content == "" {
-				m.Content = ""
-			}
 			aim.Content = json.RawMessage(fmt.Sprintf("%q", m.Content))
 		}

---

652-656: Handle potential error from rand.Read.

Similar to the generateID function in usechat.go, this should handle the potential error from rand.Read.

 func genID(prefix string) string {
 	var b [8]byte
-	_, _ = rand.Read(b[:])
+	if _, err := rand.Read(b[:]); err != nil {
+		// Fallback to timestamp-based ID if random generation fails
+		return fmt.Sprintf("%s_%d", prefix, time.Now().UnixNano())
+	}
 	return fmt.Sprintf("%s_%s", prefix, hex.EncodeToString(b[:]))
 }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

aiprompts/usechat-backend-design.md (2)

10-16: Specify language for fenced code blocks.

The architecture comparison diagrams should specify a language for better rendering.

 ### Current Architecture
-```
+```text
 Frontend (React) → Custom RPC → Go Backend → AI Providers
 - 10+ Jotai atoms for state management
 - Custom WaveAIStreamRequest/WaveAIPacketType
 - Complex configuration merging in frontend
 - Custom streaming protocol over WebSocket

Target Architecture

- +text
Frontend (useChat) → HTTP/SSE → Go Backend → AI Providers

• Single useChat() hook manages all state
• Standard HTTP POST + SSE streaming
• Backend-driven configuration resolution
• Standard AI SDK streaming format

Also applies to: 19-25

---

32-40: Add language specifiers to remaining code blocks.

Several code blocks are missing language specifiers which helps with syntax highlighting and readability.

 **Chat Streaming Endpoint:**
-```
+```text
 POST /api/ai/chat/{blockId}?preset={presetKey}

Conversation Persistence Endpoints:
- +text
POST /api/ai/conversations/{blockId} # Save conversation
GET /api/ai/conversations/{blockId} # Load conversation

**Headers:**
-```
+```http
Content-Type: text/event-stream
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Origin: *

useChat Expected Format:
- +text
data: {"type":"text","text":"Hello"}

data: {"type":"text","text":" world"}

data: {"type":"text","text":"!"}

data: {"type":"finish","finish_reason":"stop","usage":{"prompt_tokens":10,"completion_tokens":3,"total_tokens":13}}

data: [DONE]

**Error Format:**
-```
+```text
data: {"type":"error","error":"API key invalid"}

data: [DONE]

URL-based Configuration

- +text
POST /api/ai/chat/block-123?preset=claude-coding
POST /api/ai/chat/block-456?preset=gpt4-creative

### Header-based Overrides
-```
+```http
POST /api/ai/chat/block-123
X-AI-Model: gpt-4-turbo
X-AI-Temperature: 0.8

Also applies to: 145-150, 153-177, 439-461

</blockquote></details>
<details>
<summary>pkg/waveai/usechat-openai-responses.go (1)</summary><blockquote>

`187-191`: **Simplify redundant finish reason logic**

The finish reason assignment is redundant - it always sets "stop" regardless of the condition.

```diff
-				finishReason := "stop"
-				if responseDone.Response.Status == "completed" {
-					finishReason = "stop"
-				}
+				finishReason := "stop"
+				// TODO: Map different response statuses to appropriate finish reasons

cmd/testai/testschema.json (1)

17-17: Non-standard JSON Schema property

The units property is not part of the JSON Schema specification. Consider using the description field to document units or use a custom annotation with an x- prefix.

-				"units": "s"
+				"x-units": "s"

Or include the unit in the description:

-				"description": "Polling interval for GitHub API requests",
+				"description": "Polling interval for GitHub API requests (in seconds)",

cmd/testai/main-testai.go (1)

167-168: Remove trailing whitespace

There's trailing whitespace on line 168.

 		tools = getToolDefinitions()
 	}
-	
+
 	stopReason, err := waveai.StreamAnthropicResponses(ctx, sseHandler, opts, messages, tools)

pkg/waveai/usechat.go (1)

91-95: Improve error handling for preset unmarshaling

The error from JSON unmarshaling is silently ignored. Consider logging the error for debugging purposes.

 			presetAiSettings = &wconfig.AiSettingsType{}
 			if err := json.Unmarshal(mustMarshal(preset), presetAiSettings); err == nil {
 				// Successfully unmarshaled preset
 			} else {
+				log.Printf("Warning: Failed to unmarshal preset %s: %v", presetKey, err)
 				presetAiSettings = nil
 			}

pkg/waveai/usechat-anthropic.go (1)

308-309: Consider potential scanner buffer overflow for very large SSE events.

Setting a large maximum buffer size (8MB) is good, but the code doesn't handle the case where a line exceeds even this limit.

Consider logging a warning or handling this edge case explicitly if scanner.Err() returns bufio.ErrTooLong.

pkg/waveai/ssehandlerch.go (2)

217-222: Potential race condition with error channel.

The error channel has a buffer of 1, but the comment says "Send error to error channel if there's space" with a non-blocking select. If multiple errors occur concurrently, only the first will be captured in errCh. Consider if this is the intended behavior or if you need a larger buffer or different error handling strategy.

---

241-242: Inconsistent error messages for full channel conditions.

The error message "write channel is full" could be more helpful by indicating that this is likely a backpressure issue.

 	default:
-		return fmt.Errorf("write channel is full")
+		return fmt.Errorf("SSE write channel is full (backpressure)")

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

pkg/waveai/usechat.go (3)

166-170: Handle crypto/rand.Read error in generateID.

Avoid ignoring entropy errors; add a safe fallback.

 func generateID() string {
 	bytes := make([]byte, 16)
-	rand.Read(bytes)
+	if _, err := rand.Read(bytes); err != nil {
+		// fallback: time-based id (low collision risk for our usage)
+		return fmt.Sprintf("%x", time.Now().UnixNano())
+	}
 	return hex.EncodeToString(bytes)
 }

Also add:

-import (
+import (
+	"time"

---

209-213: Tighten API type validation (empty should not pass).

-// Support OpenAI and Anthropic
-if aiOpts.APIType != APIType_OpenAI && aiOpts.APIType != APIType_Anthropic && aiOpts.APIType != "" {
-	http.Error(w, fmt.Sprintf("Unsupported API type: %s (only OpenAI and Anthropic supported)", aiOpts.APIType), http.StatusBadRequest)
+// Support OpenAI and Anthropic only
+if aiOpts.APIType != APIType_OpenAI && aiOpts.APIType != APIType_Anthropic {
+	http.Error(w, fmt.Sprintf("Unsupported API type: %q (only 'openai' and 'anthropic' supported)", aiOpts.APIType), http.StatusBadRequest)
 	return
 }

---

55-61: Preserve ErrNotFound end-to-end; return 404 (not 500).

You now wrap with %w (good), but HandleAIChat treats all resolveAIConfig errors as 500. Map wstore.ErrNotFound to 404.

@@
-import (
+import (
 	"context"
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"errors"
 	"log"
 	"net/http"
 	"strings"
@@
-	aiOpts, err := resolveAIConfig(r.Context(), blockId, presetKey, req.Options)
-	if err != nil {
-		http.Error(w, fmt.Sprintf("Configuration error: %v", err), http.StatusInternalServerError)
-		return
-	}
+	aiOpts, err := resolveAIConfig(r.Context(), blockId, presetKey, req.Options)
+	if err != nil {
+		if errors.Is(err, wstore.ErrNotFound) {
+			http.Error(w, "block not found", http.StatusNotFound)
+			return
+		}
+		http.Error(w, fmt.Sprintf("Configuration error: %v", err), http.StatusInternalServerError)
+		return
+	}

Also applies to: 195-200

pkg/waveai/usechat-anthropic.go (3)

1-10: Clean up documentation artifacts and incorrect package preamble.

Remove :contentReference[...] tokens and fix package comment to match package waveai.

-// Package anthropicadapter streams Anthropic Messages API events and adapts them
+// Package waveai streams Anthropic Messages API events and adapts them
@@
-// protocol (start/text-start/text-delta/text-end, reasoning-*, tool-input-*, finish, finish-step) :contentReference[oaicite:0]{index=0}
+// protocol (start/text-start/text-delta/text-end, reasoning-*, tool-input-*, finish, finish-step)
@@
-// content_block_start/delta/stop, message_delta, message_stop, error). :contentReference[oaicite:1]{index=1} :contentReference[oaicite:2]{index=2}
+// content_block_start/delta/stop, message_delta, message_stop, error).
@@
-// same shape. Adapt the import/alias as needed in your codebase. :contentReference[oaicite:3]{index=3}
+// same shape. Adapt the import/alias as needed in your codebase.
@@
-// Derived from anthropic-messages-api.md and anthropic-streaming.md. :contentReference[oaicite:6]{index=6} :contentReference[oaicite:7]{index=7}
+// Derived from anthropic-messages-api.md and anthropic-streaming.md.
@@
-// input_json_delta (concat, then parse once on content_block_stop). :contentReference[oaicite:8]{index=8}
+// input_json_delta (concat, then parse once on content_block_stop).
@@
-// - On Anthropic error event: AiMsgError and return StopKindError. :contentReference[oaicite:9]{index=9} :contentReference[oaicite:10]{index=10}
+// - On Anthropic error event: AiMsgError and return StopKindError.
@@
-endpoint := strings.TrimRight(baseURL, "/") + "/v1/messages" // :contentReference[oaicite:11]{index=11}
+endpoint := strings.TrimRight(baseURL, "/") + "/v1/messages"
@@
-// Request streaming SSE. :contentReference[oaicite:14]{index=14}
+// Request streaming SSE.
@@
-// Try to decode Anthropic error JSON schema then surface it. :contentReference[oaicite:15]{index=15}
+// Try to decode Anthropic error JSON schema then surface it.
@@
-// Event model: anthropic-streaming.md. :contentReference[oaicite:16]{index=16}
+// Event model: anthropic-streaming.md.
@@
-// Example: data: {"type":"error","error":{"type":"overloaded_error","message":"Overloaded"}} :contentReference[oaicite:17]{index=17}
+// Example: data: {"type":"error","error":{"type":"overloaded_error","message":"Overloaded"}}
@@
-// ignore other block types gracefully per Anthropic guidance :contentReference[oaicite:18]{index=18}
+// ignore other block types gracefully per Anthropic guidance
@@
-// ignore; integrity metadata for thinking blocks. :contentReference[oaicite:19]{index=19}
+// ignore; integrity metadata for thinking blocks.
@@
-// ignore unknown deltas gracefully. :contentReference[oaicite:20]{index=20}
+// ignore unknown deltas gracefully.
@@
-// Unknown event names may appear over time; ignore. :contentReference[oaicite:22]{index=22}
+// Unknown event names may appear over time; ignore.
@@
-// body with stream=true and configured model/max_tokens. :contentReference[oaicite:23]{index=23}
+// body with stream=true and configured model/max_tokens.
@@
-// Content may be a string or array of blocks; support text only. :contentReference[oaicite:24]{index=24}
+// Content may be a string or array of blocks; support text only.
@@
-// Shorthand: string becomes a single text block. :contentReference[oaicite:25]{index=25}
+// Shorthand: string becomes a single text block.

Also applies to: 69-70, 151-153, 189-196, 217-225, 260-261, 284-285, 388-389, 404-405, 468-469, 500-503, 596-599, 602-604, 618-619, 632-633

---

213-225: Validate and normalize BaseURL before building endpoint.

-	baseURL := opts.BaseURL
+	baseURL := opts.BaseURL
 	if baseURL == "" {
 		baseURL = "https://api.anthropic.com"
 	}
-	endpoint := strings.TrimRight(baseURL, "/") + "/v1/messages"
+	u, uerr := url.Parse(baseURL)
+	if uerr != nil || u.Scheme == "" || u.Host == "" {
+		return nil, fmt.Errorf("invalid base URL: %q", baseURL)
+	}
+	endpoint := strings.TrimRight(u.String(), "/") + "/v1/messages"

---

550-556: Bug: message_stop reads transient stopFromDelta instead of persisted finalStop.

This can drop the stop_reason; use the function param finalStop.

-		reason := "end_turn"
-		if stopFromDelta != nil && *stopFromDelta != "" {
-			reason = *stopFromDelta
-		}
+		reason := "end_turn"
+		if finalStop != "" {
+			reason = finalStop
+		}

pkg/waveai/ssehandlerch.go (1)

365-370: Include finishReason and usage in AiMsgFinish payload.

 func (h *SSEHandlerCh) AiMsgFinish(finishReason string, usage interface{}) error {
 	resp := map[string]interface{}{
 		"type": AiMsgFinish,
 	}
+	if finishReason != "" {
+		resp["finishReason"] = finishReason
+	}
+	if usage != nil {
+		resp["usage"] = usage
+	}
 	return h.WriteJsonData(resp)
 }

pkg/waveai/usechat.go (3)

172-177: CORS preflight likely incomplete; set allow headers/methods.

 if r.Method == http.MethodOptions {
-	w.WriteHeader(http.StatusOK)
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
+	w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
+	w.WriteHeader(http.StatusNoContent)
 	return
 }

If upstream middleware already sets CORS, ignore this; otherwise this fixes OPTIONS failing in browsers.

---

188-194: Limit request body size and close it.

Defend against large bodies and ensure r.Body is closed.

-// Parse request body completely before sending any response
-var req UseChatRequest
-if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+// Parse request body completely before sending any response
+r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // 1 MiB cap
+defer r.Body.Close()
+var req UseChatRequest
+if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 	http.Error(w, fmt.Sprintf("Invalid request body: %v", err), http.StatusBadRequest)
 	return
 }

---

189-193: Validate non-empty messages early.

 if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 	http.Error(w, fmt.Sprintf("Invalid request body: %v", err), http.StatusBadRequest)
 	return
 }
+if len(req.Messages) == 0 {
+	http.Error(w, "At least one message is required", http.StatusBadRequest)
+	return
+}

pkg/waveai/usechat-anthropic.go (2)

371-378: Emit finish with reason captured (not empty).

Sends finish with empty reason; prefer finalStop.

-	_ = sse.AiMsgFinish("", nil)
+	_ = sse.AiMsgFinish(finalStop, nil)

---

643-647: Handle crypto/rand errors in genID.

 func genID(prefix string) string {
 	var b [8]byte
-	_, _ = rand.Read(b[:])
+	if _, err := rand.Read(b[:]); err != nil {
+		return fmt.Sprintf("%s_%x", prefix, time.Now().UnixNano())
+	}
 	return fmt.Sprintf("%s_%s", prefix, hex.EncodeToString(b[:]))
 }

And ensure time is imported if not already.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

cmd/testai/main-testai.go (1)

100-139: Use the --tools flag in OpenAI path and pass tools to StreamOpenAIToUseChat

The withTools flag is ignored for OpenAI; tools are never constructed or passed, so tool flows aren’t exercised. Mirror the Anthropic path by creating tool definitions when withTools is true and pass them into the call.

 func testOpenAI(model, message string, withTools bool) {
@@
 	messages := []waveai.UseChatMessage{
 		{
 			Role:    "user",
 			Content: message,
 		},
 	}
 
+	var tools []waveai.ToolDefinition
+	if withTools {
+		tools = getToolDefinitions()
+		fmt.Printf("Tools enabled: %d tools configured\n", len(tools))
+	}
+
 	fmt.Printf("Testing OpenAI streaming with model: %s\n", model)
 	fmt.Printf("Message: %s\n", message)
 	fmt.Println("---")
@@
-	_, err = waveai.StreamOpenAIToUseChat(ctx, sseHandler, opts, messages, nil)
+	stopReason, err := waveai.StreamOpenAIToUseChat(ctx, sseHandler, opts, messages, tools)
 	if err != nil {
 		fmt.Printf("Error streaming OpenAI: %v\n", err)
 	}
+	if stopReason != nil {
+		fmt.Printf("Stop reason: %+v\n", stopReason)
+	}

pkg/waveai/usechat.go (2)

240-244: Tighten API type validation (don’t special-case empty string here)

You already default APIType to OpenAI in resolveAIConfig. Simplify validation to only accept known values.

-	// Support OpenAI and Anthropic
-	if aiOpts.APIType != APIType_OpenAI && aiOpts.APIType != APIType_Anthropic && aiOpts.APIType != "" {
-		http.Error(w, fmt.Sprintf("Unsupported API type: %s (only OpenAI and Anthropic supported)", aiOpts.APIType), http.StatusBadRequest)
+	// Support OpenAI and Anthropic
+	if aiOpts.APIType != APIType_OpenAI && aiOpts.APIType != APIType_Anthropic {
+		http.Error(w, fmt.Sprintf("Unsupported API type: %s (only 'openai' and 'anthropic' supported)", aiOpts.APIType), http.StatusBadRequest)
 		return
 	}

---

197-201: Handle crypto/rand.Read error in generateID (fallback or propagate)

rand.Read can fail; ignoring the error risks returning an all-zero ID. Add error handling and a safe fallback.

 func generateID() string {
 	bytes := make([]byte, 16)
-	rand.Read(bytes)
+	if _, err := rand.Read(bytes); err != nil {
+		// Fallback to time-based ID if CSPRNG fails
+		return fmt.Sprintf("%x", time.Now().UnixNano())
+	}
 	return hex.EncodeToString(bytes)
 }

Also add missing imports:

 import (
 	"context"
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"errors"
 	"log"
 	"net/http"
 	"strings"
+	"time"

pkg/waveai/usechat.go (2)

107-124: Avoid shadowing presetKey and use a clearer name for the preset map key

The inner var presetKey string shadows the function parameter presetKey, which is confusing and error-prone. Rename the inner variable to something distinct.

 	// Load preset configuration
 	var presetAiSettings *wconfig.AiSettingsType
 	if finalPreset != "default" {
-		var presetKey string
+		var presetMapKey string
 		if strings.HasPrefix(finalPreset, "ai@") {
-			presetKey = finalPreset
+			presetMapKey = finalPreset
 		} else {
-			presetKey = fmt.Sprintf("ai@%s", finalPreset)
+			presetMapKey = fmt.Sprintf("ai@%s", finalPreset)
 		}
-		if preset, ok := fullConfig.Presets[presetKey]; ok {
+		if preset, ok := fullConfig.Presets[presetMapKey]; ok {
 			presetAiSettings = &wconfig.AiSettingsType{}
 			if err := json.Unmarshal(mustMarshal(preset), presetAiSettings); err == nil {
 				// Successfully unmarshaled preset
 			} else {
 				presetAiSettings = nil
 			}
 		}
 	}

---

203-209: Preflight response lacks CORS headers

If CORS isn’t injected by an upstream middleware, OPTIONS should include Access-Control-Allow-* headers. Verify upstream handling; if absent, add them here.

Would you like me to add a minimal header set here guarded by a dev flag?

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

cmd/testai/main-testai.go (1)

100-139: Hook up --tools for OpenAI path (parity with Anthropic).

withTools is ignored here, so OpenAI streaming never exercises tool support. Pass tools when requested and surface the stop reason (matches Anthropic test).

Apply:

 func testOpenAI(model, message string, withTools bool) {
@@
 	messages := []waveai.UseChatMessage{
 		{
 			Role:    "user",
 			Content: message,
 		},
 	}
 
+	var tools []waveai.ToolDefinition
+	if withTools {
+		tools = getToolDefinitions()
+		fmt.Printf("Tools enabled: %d tools configured\n", len(tools))
+	}
+
 	fmt.Printf("Testing OpenAI streaming with model: %s\n", model)
 	fmt.Printf("Message: %s\n", message)
 	fmt.Println("---")
@@
 	defer sseHandler.Close()
 
-	_, err = waveai.StreamOpenAIToUseChat(ctx, sseHandler, opts, messages, nil)
+	stop, err := waveai.StreamOpenAIToUseChat(ctx, sseHandler, opts, messages, tools)
 	if err != nil {
 		fmt.Printf("Error streaming OpenAI: %v\n", err)
 	}
+	if stop != nil {
+		fmt.Printf("Stop reason: %+v\n", stop)
+	}
 }

pkg/waveai/usechat.go (2)

197-201: Handle crypto/rand.Read errors in ID generation.

Avoid ignoring failures; provide a safe fallback.

Apply:

 func generateID() string {
 	bytes := make([]byte, 16)
-	rand.Read(bytes)
-	return hex.EncodeToString(bytes)
+	if _, err := rand.Read(bytes); err != nil {
+		// extremely unlikely; fall back to timestamp-based ID
+		return fmt.Sprintf("id_%x", time.Now().UnixNano())
+	}
+	return hex.EncodeToString(bytes)
 }

And add import:

-	"log"
+	"log"
+	"time"

---

240-244: Tighten API type validation (empty string shouldn’t slip through).

Defaulting to OpenAI earlier means this check can be simplified and made stricter.

Apply:

-	// Support OpenAI and Anthropic
-	if aiOpts.APIType != APIType_OpenAI && aiOpts.APIType != APIType_Anthropic && aiOpts.APIType != "" {
-		http.Error(w, fmt.Sprintf("Unsupported API type: %s (only OpenAI and Anthropic supported)", aiOpts.APIType), http.StatusBadRequest)
+	// Support exactly 'openai' or 'anthropic'
+	if aiOpts.APIType != APIType_OpenAI && aiOpts.APIType != APIType_Anthropic {
+		http.Error(w, fmt.Sprintf("Unsupported API type: %s (only 'openai' and 'anthropic' supported)", aiOpts.APIType), http.StatusBadRequest)
 		return
 	}

pkg/waveai/usechat-anthropic.go (2)

1-10: Clean up package comment and doc artifacts.

Top comment names wrong package and several lines contain generated :contentReference markers. Remove artifacts and fix the package comment.

Apply:

-// Package anthropicadapter streams Anthropic Messages API events and adapts them
+// Package waveai streams Anthropic Messages API events and adapts them
 // to our AI‑SDK style SSE parts. Mapping is based on the AI‑SDK data stream
-// protocol (start/text-start/text-delta/text-end, reasoning-*, tool-input-*, finish, finish-step) :contentReference[oaicite:0]{index=0}
+// protocol (start/text-start/text-delta/text-end, reasoning-*, tool-input-*, finish, finish-step)
 // and Anthropic's Messages + Streaming event schemas (message_start,
-// content_block_start/delta/stop, message_delta, message_stop, error). :contentReference[oaicite:1]{index=1} :contentReference[oaicite:2]{index=2}
+// content_block_start/delta/stop, message_delta, message_stop, error).
@@
-// Derived from anthropic-messages-api.md and anthropic-streaming.md. :contentReference[oaicite:6]{index=6} :contentReference[oaicite:7]{index=7}
+// Derived from anthropic-messages-api.md and anthropic-streaming.md.
@@
-// input_json_delta (concat, then parse once on content_block_stop). :contentReference[oaicite:8]{index=8}
+// input_json_delta (concat, then parse once on content_block_stop).
@@
-// - On Anthropic error event: AiMsgError and return StopKindError. :contentReference[oaicite:9]{index=10}
+// - On Anthropic error event: AiMsgError and return StopKindError.
@@
-		// Example: data: {"type":"error","error":{"type":"overloaded_error","message":"Overloaded"}} :contentReference[oaicite:17]{index=17}
+		// Example: data: {"type":"error","error":{"type":"overloaded_error","message":"Overloaded"}}
@@
-			// ignore other block types gracefully per Anthropic guidance :contentReference[oaicite:18]{index=18}
+			// ignore other block types gracefully per Anthropic guidance
@@
-			// ignore; integrity metadata for thinking blocks. :contentReference[oaicite:19]{index=19}
+			// ignore; integrity metadata for thinking blocks.
@@
-		// Unknown event names may appear over time; ignore. :contentReference[oaicite:22]{index=22}
+		// Unknown event names may appear over time; ignore.
@@
-		// Content may be a string or array of blocks; support text only. :contentReference[oaicite:24]{index=24}
+		// Content may be a string or array of blocks; support text only.
@@
-			// Shorthand: string becomes a single text block. :contentReference[oaicite:25]{index=25}
+			// Shorthand: string becomes a single text block.

Also applies to: 47-49, 130-131, 166-176, 334-336, 398-400, 430-434, 528-529, 572-575, 588-593

---

545-551: Validate and normalize base URL.

Avoid concatenating unvalidated base URLs; parse and ensure scheme/host.

Apply:

-	baseURL := opts.BaseURL
-	if baseURL == "" {
-		baseURL = AnthropicDefaultBaseURL
-	}
-	endpoint := strings.TrimRight(baseURL, "/") + "/v1/messages"
+	baseURL := opts.BaseURL
+	if baseURL == "" {
+		baseURL = AnthropicDefaultBaseURL
+	}
+	u, err := url.Parse(baseURL)
+	if err != nil || u.Scheme == "" || u.Host == "" {
+		return nil, fmt.Errorf("invalid base URL: %q", baseURL)
+	}
+	endpoint := strings.TrimRight(u.String(), "/") + "/v1/messages"

pkg/waveai/usechat-openai-responses.go (1)

118-118: Gate debug prints behind dev mode.

Avoid unconditional stdout logging in production.

Apply:

-		fmt.Printf("DEBUG: Received event type: %s\n", event.Type)
+		if wavebase.IsDevMode() {
+			fmt.Printf("DEBUG: Received event type: %s\n", event.Type)
+		}
@@
-			fmt.Printf("DEBUG: reasoning delta - reasoningEnded=%t, delta='%s'\n", reasoningEnded, reasoningDelta.Delta)
+			if wavebase.IsDevMode() {
+				fmt.Printf("DEBUG: reasoning delta - reasoningEnded=%t, delta='%s'\n", reasoningEnded, reasoningDelta.Delta)
+			}
@@
-			fmt.Printf("DEBUG: reasoning summary text done - reasoningStarted=%t, reasoningEnded=%t (not ending here, waiting for output_item.done)\n", reasoningStarted, reasoningEnded)
+			if wavebase.IsDevMode() {
+				fmt.Printf("DEBUG: reasoning summary text done - reasoningStarted=%t, reasoningEnded=%t (not ending here, waiting for output_item.done)\n", reasoningStarted, reasoningEnded)
+			}
@@
-			// Log unhandled event types in dev mode
-			if wavebase.IsDevMode() {
+			// Log unhandled event types in dev mode
+			if wavebase.IsDevMode() {
 				fmt.Printf("DEBUG: Unhandled event type: %s\n", event.Type)
 			}

Also applies to: 134-134, 140-140, 207-211

pkg/waveai/usechat.go (2)

77-81: Allow tool definitions in the HTTP request (optional).

If you intend to support ToolUse via HTTP, add Tools to the request DTO and pass through to backends.

Apply:

 type UseChatRequest struct {
 	Messages []UseChatMessage        `json:"messages"`
 	Options  *wconfig.AiSettingsType `json:"options,omitempty"`
+	Tools    []ToolDefinition        `json:"tools,omitempty"`
 }

And:

-	if aiOpts.APIType == APIType_Anthropic {
-		_, err := StreamAnthropicResponses(r.Context(), sseHandler, aiOpts, req.Messages, nil)
+	if aiOpts.APIType == APIType_Anthropic {
+		_, err := StreamAnthropicResponses(r.Context(), sseHandler, aiOpts, req.Messages, req.Tools)
 		if err != nil {
 			log.Printf("Anthropic streaming error: %v", err)
 		}
 	} else {
 		// Default to OpenAI
-		_, err := StreamOpenAIToUseChat(r.Context(), sseHandler, aiOpts, req.Messages, nil)
+		_, err := StreamOpenAIToUseChat(r.Context(), sseHandler, aiOpts, req.Messages, req.Tools)
 		if err != nil {
 			log.Printf("OpenAI streaming error: %v", err)
 		}
 	}

Also applies to: 260-272

---

182-195: Consider returning the real StopReason from OpenAI paths.

Wrapper currently always returns Kind=done, which hides tool_use/max_tokens endings on Responses API. Unify return semantics with Anthropic for observability.

pkg/waveai/usechat-anthropic.go (1)

615-619: Handle crypto/rand failure when generating IDs.

Add a minimal fallback; time is already imported.

Apply:

 func genID(prefix string) string {
 	var b [8]byte
-	_, _ = rand.Read(b[:])
+	if _, err := rand.Read(b[:]); err != nil {
+		return fmt.Sprintf("%s_%d", prefix, time.Now().UnixNano())
+	}
 	return fmt.Sprintf("%s_%s", prefix, hex.EncodeToString(b[:]))
 }

pkg/waveai/usechat-openai-responses.go (3)

92-98: Honor TimeoutMs like the Anthropic path.

Wrap ctx with a timeout when provided for parity and to prevent hanging streams.

Apply:

 func StreamOpenAIResponsesAPI(sseHandler *SSEHandlerCh, ctx context.Context, opts *wshrpc.WaveAIOptsType, messages []UseChatMessage, tools []ToolDefinition) {
+	if opts.TimeoutMs > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, time.Duration(opts.TimeoutMs)*time.Millisecond)
+		defer cancel()
+	}
 	client, req := createOpenAIRequest(opts, messages, tools)

And add import:

 import (
 	"context"
 	"fmt"
+	"time"
 	"strings"

---

19-33: Validate non-empty message input or document behavior.

If all messages are filtered out as empty, the request has an empty Input list. Consider validating earlier and returning an explicit error to callers, or inject a minimal system/user placeholder.

Also applies to: 59-90

---

19-33: Proxy support parity with Anthropic (optional).

If opts.ProxyURL is set, configure the OpenAI client with a custom HTTP client using that proxy.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro