fix(split-io): correct segment key API paths and dashboard auth field

[andrei-hasna]

Objective

fix(split-io): correct segment key API paths and dashboard auth field

Verifier found HIGH issues on PR #314 branch: (1) addKeysToSegment POSTs to /uploadKeys instead of /keys per Split Admin API v2 OpenAPI; (2) removeKeysFromSegment uses PUT /removeKeys instead of DELETE /keys; (3) dashboard guessKeyField stores ioApiKey for SPLIT_IO_API_KEY but CLI getApiKey only reads apiKey; (4) segment CLI args should document environmentId not display name. Fix on branch open-c

Re-verify the current split-io connector source on origin/main before changing anything. Three defects found by a verifier on the PR #314 branch, all in the Split.io connector: (1) addKeysToSegment POSTs to /uploadKeys but the Split Admin API v2 OpenAPI defines /keys; (2) removeKeysFromSegment uses PUT /removeKeys but the documented operation is DELETE /keys; (3) the dashboard's guessKeyField stores the value under ioApiKey for the SPLIT_IO_API_KEY credential while the client reads a different field, so a configured key is never found. FIX in src/: correct the two endpoint paths and HTTP verbs, and make the credential field name consistent between the dashboard writer and the client reader (fix it in the one place that maps env var -> stored field, not at both ends). Regression tests must run offline: assert on the REQUEST the client would issue (method + path + body) using an injected fetch/HTTP stub — do NOT call the live Split.io API, there are no credentials and no network.

EXECUTION NOTES (added 2026-07-29 for autonomous execution)
Work only in this repo, only in src/. Add a regression test that fails on current main and passes after the fix (this codebase is test-driven). Acceptance: bun install, bun run typecheck (if present), bun run build and bun test all green. The executing environment has NO network egress, NO credentials and NO live services (no Postgres, no AWS, no third-party APIs) — the test must run entirely offline against fixtures, temp dirs, local SQLite or an in-process stub.

Verification

• policy source: base a30f90b (immutable commit — agent-proof)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: pass
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_9202efbf8b9c · backend codewith · task 20f06949-8130-413f-889b-84a4e8a59d42
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #338 @ cb96096 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git log --oneline origin/main..HEAD: exit 0; one commit, cb960960 fix(split-io): correct segment key API paths and dashboard auth field.
• git diff origin/main...HEAD --stat: exit 0; 5 files changed, 45 insertions, 21 deletions.
• bun install: exit 0.
• bun run typecheck: exit 0; typecheck is defined as tsc --noEmit && tsc -p tsconfig.social.json --noEmit.
• bun test: exit 1; 3789 passed, 190 failed. The first failures are MCP/CLI/server entry tests that spawn built bin/* files, starting with missing /home/hasna/.hasna/repos/worktrees/open-connectors/pr338-review/bin/mcp.js.

What I read:

• Full PR diff for connectors/split-io/src/api/client.ts, connectors/split-io/src/api/client.test.ts, connectors/split-io/src/api/index.ts, connectors/split-io/src/cli/index.ts, and src/server/auth.ts.
• Full changed-file source and surrounding call paths in the Split.io API wrapper, Split.io CLI, server auth storage/field guessing, connector resolver, installer docs parsing, and existing auth tests.
• Official Split docs for segment-key endpoints: GET keys is /segments/{environment-id}/{segment-name}/keys, JSON upload is PUT /segments/{environment-id}/{segment-name}/uploadKeys?replace=false, and JSON removal is PUT /segments/{environment-id}/{segment-name}/removeKeys.

Blocking P0/P1 findings:

• P1 correctness: SplitIo.addKeysToSegment() now POSTs to /segments/{environment}/{segment}/keys, but the official JSON upload endpoint remains PUT /segments/{environment-id}/{segment-name}/uploadKeys?replace=false. The real CLI path connect-split-io segments add-keys ... calls this wrapper, so the changed code sends add-key requests to the wrong method/path.
• P1 correctness: SplitIo.removeKeysFromSegment() now sends DELETE /segments/{environment}/{segment}/keys with a JSON body, but the official JSON removal endpoint remains PUT /segments/{environment-id}/{segment-name}/removeKeys. The real CLI path connect-split-io segments remove-keys ... calls this wrapper, so key removal is broken on the documented API path.
• Required gate failed: bun test exited 1 in this worktree, so the requested test gate is not green.

Non-blocking follow-ups:

• The Split.io CLI help now says <environmentId> for segment-key commands while README/CLAUDE examples still say <environmentName>. The docs are inconsistent, but this is documentation/help alignment and not the primary blocker.
• src/server/auth.ts improves default key-field guessing for hyphenated connector names such as split-io with SPLIT_IO_API_KEY; I did not find a blocking issue in that change.

[andrei-hasna]

Remediation pushed by reviewer Augustus.

Fixed in 286f0a6f294ac2866227a9b71d92b70c6d47b293:

• Restored SplitIo.addKeysToSegment() to the documented PUT /segments/{environment-id}/{segment-name}/uploadKeys?replace=false endpoint.
• Restored SplitIo.removeKeysFromSegment() to the documented PUT /segments/{environment-id}/{segment-name}/removeKeys endpoint.
• Reverted the Split.io client DELETE-body change because segment-key removal no longer uses DELETE.
• Updated the Split.io API tests to assert the documented write endpoints.

Verification after the fix:

• bun test connectors/split-io/src/api/client.test.ts: exit 0.
• bun run typecheck: exit 0.
• bun run check:package-secrets: exit 0.
• staged-diff credential-pattern scan: exit 0.

The earlier required full-suite gate remains recorded on the review comment: bun test exited 1 at the reviewed head before this fix, with failures starting in MCP/CLI/server entry tests expecting built bin/* files.

[andrei-hasna]

[REVIEW] GO — #338 @ 286f0a6 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git rev-parse HEAD: 0, returned 286f0a6f294ac2866227a9b71d92b70c6d47b293.
• git status --short --branch: 0, on lane-pr338 with no tracked changes.
• git log --oneline origin/main..HEAD: 0, reviewed commits cb960960 and 286f0a6f.
• git diff origin/main...HEAD --stat: 0, 3 changed files, 35 insertions, 11 deletions.
• Full diffs for connectors/split-io/src/api/client.test.ts, connectors/split-io/src/cli/index.ts, and src/server/auth.ts: 0.
• bun install: 0.
• bun run typecheck: 0.
• bun test: 1 before generated bin/ entrypoints existed; failures started at src/mcp/mcp.test.ts because bin/mcp.js was absent and cascaded through CLI/MCP/server entrypoint tests.
• bun test connectors/split-io/src/api/client.test.ts: 0.
• bun test src/server/server-auth.test.ts: 0.
• bun run build: 0.
• bun test after build: 0, 3979 pass, 0 fail.
• Split.io auth save/status sanity with an isolated temporary home under the worktree: 0; saving split-io derived field apiKey and getAuthStatus('split-io') reported SPLIT_IO_API_KEY set from stored config.
• gh pr view 338 --repo hasna/connectors --json headRefOid,headRefName,baseRefName,isDraft,mergeStateStatus,state,reviewDecision: 0, PR still at the assigned head, open, not draft, clean merge state.

What I read:

• Full diff of every changed file: connectors/split-io/src/api/client.test.ts, connectors/split-io/src/cli/index.ts, src/server/auth.ts.
• Surrounding source for the touched behavior: connectors/split-io/src/api/index.ts, connectors/split-io/src/api/client.ts, the Split.io CLI segment command block and config utility, src/server/auth.ts auth save/status helpers, src/lib/connector-resolver.ts, src/lib/installer.ts, src/server/server-auth.test.ts, src/mcp/mcp.test.ts, src/cli/cli.test.ts, connectors/split-io/CLAUDE.md, and package.json scripts.

Blocking P0/P1 findings:

• None. The changed Split.io segment key methods use the expected encoded segment/environment path shape, removeKeysFromSegment is covered with PUT removeKeys, CLI segment-key arguments now match the environment-id route semantics, and the dashboard auth field inference now derives apiKey for SPLIT_IO_API_KEY instead of ioApiKey.
• The initial raw bun test failure was a generated-entrypoint prerequisite issue in this worktree, not a candidate regression: after bun run build, the same full suite passed.

Non-blocking follow-ups:

• If this repository intends bun test to be runnable from a clean checkout without a prior build, the CLI/MCP/server entrypoint tests should either build or invoke source entrypoints. Today they require generated ignored bin/* files; the package prepublishOnly order already builds before testing.