[boomzero]

Why

Every deploy since #72 fails: Cloudflare can't attach the ai binding to a new version of this worker (binding AI of type ai failed to generate … [code: 10021]). It fails with wrangler 4.114 and 4.147, in Workers Builds and locally, and the dashboard's AI → Models page errors out too. Other accounts are hitting the same thing: cloudflare/workers-sdk#15973. The version already running can still call Workers AI; only creating new versions is broken.

What

• Remove the [ai] block from wrangler.toml, so deploys go through again (including fix: stop logging raw PHPSESSID values #72's log fix).
• Badge moderation calls the Workers AI REST API (/accounts/{ACCOUNT_ID}/ai/run/{model}) using the existing API_TOKEN secret (the Analytics Engine token), or a separate AI_API_TOKEN if one is set. The client has the same run() shape as the binding and returns the binding's output (the API's result), so the moderation code and its parsing don't change.
• If the binding ever comes back, it's used first.
• With neither a binding nor a token, run throws inside the existing try block, and the edit is refused with 「内容审核服务暂时不可用」. Unmoderated badges never get through.

Before merging (merge auto-deploys)

1. In the dashboard, edit the token stored as API_TOKEN and add Account → Workers AI → Read. Editing permissions keeps the token value, so the secret doesn't change.
2. Check it can run the model:

   curl -s https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/ai/run/@cf/zai-org/glm-4.7-flash \
     -H "Authorization: Bearer <token>" -d '{"messages":[{"role":"user","content":"hi"}]}' | head -c 300
   

3. Merge. The auto-deploy should succeed now that there is no ai binding, and badge moderation keeps working without any gap.

Tests

npm test: 144 pass. The 9 new tests cover the request URL, auth and body, HTTP errors, success: false with a 200, a non-JSON body, binding-first selection, AI_API_TOKEN over API_TOKEN, the API_TOKEN fallback, and refusing the edit when there is no AI at all. wrangler deploy --dry-run builds with no AI binding.

🤖 Generated with Claude Code

https://claude.ai/code/session_017dqWu3YgeVRGwBt5pXDq4A

Summary by Sourcery

Replace the unavailable Workers AI binding with a resilient HTTP-based integration so deployments succeed and badge moderation remains enforced.

New Features:

• Route Workers AI moderation requests through the Workers AI REST API using a dedicated token or the existing API token, while retaining binding support when available.

Bug Fixes:

• Allow new worker versions to deploy without relying on the failing Workers AI binding.
• Reject moderation edits cleanly when no Workers AI binding or token is available.

Enhancements:

• Preserve the existing moderation interface and handle unsuccessful or malformed Workers AI responses as errors.

Build:

• Remove the Workers AI binding configuration from wrangler.toml.

Tests:

• Add coverage for REST API requests, authentication fallback, binding precedence, error responses, and moderation behavior without AI access.

[sourcery-ai]

Reviewer's Guide

The worker no longer declares a Workers AI binding, avoiding the deployment failure, and instead uses an authenticated Workers AI REST client that matches the binding’s run interface. Existing bindings remain preferred for compatibility, while missing AI configuration fails closed during badge moderation; tests cover the HTTP contract, error handling, fallback selection, and refusal behavior.

Sequence diagram for badge moderation AI selection

sequenceDiagram
    participant Process
    participant Binding as WorkersAI_binding
    participant HTTP as WorkersAIOverHTTP
    participant API as WorkersAI_REST_API

    Process->>Process: Select Environment.AI or AI_API_TOKEN client
    alt binding available
        Process->>Binding: run(Model, Inputs)
        Binding-->>Process: moderation result
    else API token available
        Process->>HTTP: run(Model, Inputs)
        HTTP->>API: POST /accounts/{ACCOUNT_ID}/ai/run/{model}
        API-->>HTTP: success and result
        HTTP-->>Process: result
    else neither available
        Process->>Process: run throws
        Process-->>Process: Refuse badge edit
    end

Loading

File-Level Changes

Change	Details	Files
Replace the Workers AI binding dependency with an HTTP client while preserving the existing moderation interface.	Add a REST client that posts model inputs with account authentication and returns the API result. Treat HTTP failures, API-reported failures, and invalid JSON responses as moderation errors. Prefer the binding when available, otherwise construct the HTTP client from the account ID and secret token. Make the AI binding optional and add the AI API token environment variable.	Source/Process.ts Source/index.ts
Remove the failing AI binding configuration from deployment.	Delete the [ai] configuration block so new worker versions no longer require binding attachment.	wrangler.toml
Add coverage for HTTP invocation, fallback behavior, and moderation safety.	Test request URL, authorization, payload, successful result mapping, and failure responses. Test binding-first selection and token-based fallback. Verify badge edits are refused when neither AI mechanism is configured.	test/process.test.js

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. This changes the production worker's AI integration and introduces a bearer-token HTTP dependency, so a configuration or endpoint mistake could disable moderation or send moderation inputs through an unintended API path. Reverting restores the binding-based behavior, but requests already sent and any associated credential or data exposure would not be undone.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook