Expose authenticated provider relays for local runtimes

[ygpark80]

User description

Adds a short-lived relay command for Claude, Codex, and Gemini container adapters.

• keeps the Prism credential and account selection in the host process
• requires a fresh one-shot relay token
• limits each relay to its selected provider API route
• pins one rotated Gemini subscription account per invocation
• documents the container-runtime contract

Validation:

• go test -mod=vendor ./...
• live Claude, Codex, and Gemini container calls through the relay

---

CodeAnt-AI Description

Add authenticated provider relays for local container runtimes

What Changed

• Adds prism relay commands for Claude, Codex, and Gemini adapters
• Keeps host credentials and Gemini account selection outside the container while requiring a fresh token for every request
• Restricts each relay to its provider’s supported API routes and rejects unauthorized or cross-provider requests
• Supports automatic port selection and documents how to connect local containers to the relay

Impact

✅ Credentials stay out of provider containers
✅ Fewer unauthorized relay requests
✅ Reliable Claude, Codex, and Gemini container access

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	5cafd64	Aug 29, 2026 · 09:49	09:52

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 785b1bfb-8b16-4f2c-a390-da6dff3087c6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codeant-ai]

CodeAnt Nitpicks

1 code suggestion

1. Unauthenticated health responses disclose active relay provider information.

Security · internal/cli/relay.go:185-189