fix(admin): add the missing adminMenuItems entries for pricing/mcp-servers (#16933)

[mrveiss]

Thinking Path

/admin/pricing and /admin/mcp-servers (#16825) merged with hideInNav: true but no matching adminMenuItems entry — in this codebase that flag means "listed in the admin menu instead of the main nav", not "hidden", so both screens were reachable only by typing the URL directly. This was a blocking finding in review before #16875 merged; the finding wasn't addressed before it did.

What Changed

Added both entries to navItems.ts's adminMenuItems (icon, labelKey, to, matching every sibling admin route) and the label translation to all 11 locales. Extended nav-items-coverage.test.ts with a check the existing test structurally cannot do — it short-circuits on hideInNav: true before any membership check runs. The new check is scoped to hideInNav /admin/* routes specifically, not every hideInNav route, since the wider set has genuine other exposure paths (login, onboarding, LLC sub-tabs, dev-only pages) this file was never meant to enumerate.

Verification

• /admin/mcp-servers and /admin/pricing each have an adminMenuItems entry — icon, labelKey and to — matching the sibling admin routes
• Each labelKey exists in all 11 locales
• nav-items-coverage.test.ts also checks hideInNav routes against adminMenuItems, so an admin route with no menu entry fails CI
• That guard is proved by mutation: removes a real adminMenuItems entry and confirms the check's own matching logic would have caught it (sanity: is checking a non-empty, real set of admin routes (mutation proof, #16933 AC4))
• Not run locally: no node_modules in this checkout and the project's rule is never to install into the codebase; verified by hand-reading the added test logic and confirming both routes' meta blocks (hideInNav: true, requiresAuth: true) match the sibling admin routes the existing passing tests already cover — CI's frontend vitest suite is the real signal.

Model Used

Claude Opus 5

Single-issue rationale

A single small nav-menu wiring fix; no other open issue shares this file/scope to batch with.

Issue Link

Closes #16933

[coderabbitai]

Warning

Review limit reached

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d3a4ec09-dc7e-4e91-9df3-51a768dcf02c

📥 Commits

Reviewing files that changed from the base of the PR and between a892824 and 0e98aa2.

📒 Files selected for processing (8)

• autobot-frontend/src/i18n/locales/ar.json
• autobot-frontend/src/i18n/locales/de.json
• autobot-frontend/src/i18n/locales/en.json
• autobot-frontend/src/i18n/locales/es.json
• autobot-frontend/src/i18n/locales/fr.json
• autobot-frontend/src/i18n/locales/lv.json
• autobot-frontend/src/i18n/locales/pl.json
• autobot-frontend/src/i18n/locales/pt.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3338f332-0207-4243-8d62-0d2eb68cd891

📥 Commits

Reviewing files that changed from the base of the PR and between bf3cac7 and be5ac69.

📒 Files selected for processing (14)

• autobot-frontend/src/__tests__/nav-items-coverage.test.ts
• autobot-frontend/src/config/navItems.ts
• autobot-frontend/src/i18n/locales/ar.json
• autobot-frontend/src/i18n/locales/de.json
• autobot-frontend/src/i18n/locales/en.json
• autobot-frontend/src/i18n/locales/es.json
• autobot-frontend/src/i18n/locales/fa.json
• autobot-frontend/src/i18n/locales/fr.json
• autobot-frontend/src/i18n/locales/he.json
• autobot-frontend/src/i18n/locales/lv.json
• autobot-frontend/src/i18n/locales/pl.json
• autobot-frontend/src/i18n/locales/pt.json
• autobot-frontend/src/i18n/locales/ur.json
• changelog/unreleased/16933-admin-menu-entries.md

Included review availability: Your plan provides up to 10 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The change adds /admin/pricing and /admin/mcp-servers to the admin menu, supplies translations in 11 locales, and extends navigation coverage tests to validate hidden admin routes and menu entries.

Changes

Admin menu reachability

Layer / File(s)	Summary
Register admin menu entries and labels autobot-frontend/src/config/navItems.ts, autobot-frontend/src/i18n/locales/*.json, changelog/unreleased/16933-admin-menu-entries.md	The admin menu now includes the pricing and MCP server routes. The English, Arabic, German, Spanish, Persian, French, Hebrew, Latvian, Polish, Portuguese, and Urdu locales define both labels.
Validate admin menu coverage autobot-frontend/src/__tests__/nav-items-coverage.test.ts	The coverage tests check hidden top-level admin routes against adminMenuItems or the intentional allowlist. They also reject orphaned menu entries and test removal of /admin/pricing.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to be5ac

The two admin pages are registered in the admin menu with localized labels and regression coverage; no actionable merge risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Issue #16933 requires menu entries for /admin/pricing and /admin/mcp-servers, with an icon, labelKey, and to. navItems.ts adds both entries. The PR summary records matching translations in a…
Out of Scope Changes check	✅ Passed	The changes remain within issue #16933. The navigation entries, locale keys, coverage tests, mutation check, and changelog all support making the two admin routes reachable and preventing the same def…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (12 skipped: 1…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the missing adminMenuItems entries for pricing and MCP servers.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mrveiss]

Review verdict: APPROVE. Independent review, since this PR's author also merged #16875 — author and reviewer are kept separate from here on. All four of #16933's criteria verified against the branch.

AC	Evidence
Both routes get an adminMenuItems entry	navItems.ts — /admin/pricing → nav.adminPricing, /admin/mcp-servers → nav.adminMcpServers, each with an icon and the sibling entries' shape
Each labelKey in all 11 locales	both keys present in ar de en es fa fr he lv pl pt ur, each a real translation rather than an English placeholder (e.g. Modeļu cenas / MCP serveri, قیمت‌گذاری مدل‌ها / سرورهای MCP)
The coverage test checks hideInNav admin routes against adminMenuItems	new block adminMenuItems coverage (#16933) — every hideInNav /admin/* route has an adminMenuItems entry or is allowlisted
Proved by mutation	see below

The guard is closed in both directions, which is more than the issue asked for: the forward check fails on an admin route with no menu entry, and every adminMenuItems entry corresponds to a real route fails on a menu entry pointing at nothing — so a renamed route cannot leave a dead menu item behind.

On AC4, verified rather than taken from the test name. A mutation proof is only as good as its allowlist: if INTENTIONALLY_HIDDEN exempted either route, deleting its menu entry would leave the guard green. It does not. The allowlist holds six pre-existing entries, each with a stated reason, and neither new route is among them. So removing either adminMenuItems entry fails the forward check, and the failure message names the route. The sanity test backs this by asserting the checked set is non-empty and contains /admin/sandbox, /admin/pricing and /admin/mcp-servers — so the guard cannot pass by finding nothing to check.

Scoping it to /admin/* is the right call, and the comment explains why: for most hideInNav routes the "other way in" is genuine — login, onboarding, an LLC sub-tab — and this file was never meant to enumerate those. For admin routes, hideInNav specifically means "listed in the admin menu instead", which is exactly the contract that was unenforced.

Merge order: this branch has merged main, so it inherits main's current Secret Detection red. Merge after #16943 lands, on a fresh run of the updated head.

One pre-existing entry worth a look separately, not a blocker: /admin/users is exempted as "surfaced via separate admin entrypoint". If that entrypoint is a real menu item, the exemption is correct; if not, it is the same gap as #16933.

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(security): a delegated agent inherits its parent's authority; the originator survives relays (#16950) #16966 fix(security): a delegated agent inherits its parent's authority; the originator survives relays (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• feat(agents): live presence registry, one query across all three agent kinds (#16947) #16965 feat(agents): live presence registry, one query across all three agent kinds (feat(agents): live presence — one registry of named agents with busy/idle state, across all three kinds #16947)
• feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (#16951) #16964 feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (feat(agents): coordinate agents competing for shared resources — API limits, CPU time, queues #16951)
• fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (#16960) #16961 fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (fix(security): .secrets.baseline on main is missing 2 audited entries, blocking every PR's whole-tree secret scan #16960)
• fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959 fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (bug(kb): the doc-sync commit hook re-embeds every doc into the live KB from any worktree, because its hash cache is per-checkout #16934)
• test(security): a delegated subagent runs a write its parent is held from (#16950) #16958 test(security): a delegated subagent runs a write its parent is held from (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• test(security): the ungated-router list may only shrink, so a new entry fails (#16375) #16955 test(security): the ungated-router list may only shrink, so a new entry fails (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• fix(multimodal): the response says whether a result was stored, and if not, why (#16926) #16954 fix(multimodal): the response says whether a result was stored, and if not, why (bug(multimodal): a tenancy-refused write still returns HTTP 200 success — the persisted flag has no consumer #16926)
• fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952 fix(tests): prune SKIP dirs during the walk, not after rglob returns (ci(python-suite): intermittent hang in shard 10 — one of the 223 modules it runs on main (hit #16284 and batch 2b) #16601)
• security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939 security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (security(websocket): auth token travels in the URL query string, not a header/subprotocol #16457)
• fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938 fix(ci): chain formatter dispatch after the branch guard in pre-commit (ci(hooks): no local hook runs black/isort/ruff — formatting is first checked in CI #16923)
• fix(security): match injection patterns against what a model reads, not the raw text (#16354) #16937 fix(security): match injection patterns against what a model reads, not the raw text (security(detector): detect_injection matches its patterns before stripping invisible Unicode, so a zero-width character inside a phrase defeats the match #16354)
• fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (#16931) #16932 fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (ci(trailers): the trailer gate cannot see a release promotion — fixed fetch-depth 100 vs 808 commits #16931)
• security(rag): route the chat's RAG path through the content firewall (#16771) #16930 security(rag): route the chat's RAG path through the content firewall (security(rag): the chat RAG path builds the prompt from KB text without the content firewall #16771)
• test(api): stop racing the clock in the last completion test (#16928) #16929 test(api): stop racing the clock in the last completion test (test(api): test_completion_performance races the real clock, the defect #15861 already fixed in its siblings #16928)
• fix(security): break-glass repair of a genuinely unreachable knowledge fact or envelope secret, through each type's own service (#15779, #16940) #16927 fix(security): admin break-glass repair for unreachable null-scope resources (bug(scoping): a null-scope resource is denied to every principal including admin — un-repairable in-app #15779)
• docs(ci): the two PR gates name their importer, because pre-push cannot warn you (#16859) #16922 docs(ci): the two PR gates name their importer, because pre-push cannot warn you (ci(process): PR body requirements are undiscoverable before push — gh --body-file never loads the template, and the gate's author failed it twice #16859)
• fix(backend): resolve 4 duplicate route registrations (#16908) #16918 fix(backend): resolve 4 duplicate route registrations (bug(api): four endpoints are registered twice — the second registration is dead code #16908)
• fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (#14968) #16916 fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (RAPTOR tree nodes are built with an empty source_chunk_ids, so no tree node can cite its sources #14968)
• fix(chat): the init stops at its first await once the component unmounts (#16274) #16911 fix(chat): the init stops at its first await once the component unmounts (fix(chat): ChatInterface's init keeps running after unmount, so a slow-init test crashes a later test's fallback #16274)
• security(ai-ml): pin HuggingFace model revisions and verify weight integrity (#13034) #16899 security(ai-ml): pin HuggingFace model revisions and verify weight integrity (security(models): no revision pinning or weight integrity verification — 18 suppressed B615 findings (#13030) #13034)
• security(api): gate captcha, metrics and diagnostics routers (#16375) #16896 security(api): gate captcha, metrics and diagnostics routers (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• security(secrets): content-scanning credential redactor -- catches a credential in free text (#13708) #16895 security(secrets): content-scanning credential redactor -- catches a credential in free text (security(secrets): credential redaction is name-keyed and cannot see credentials in free text — add content scanning before mail is indexed #13708)
• fix(ci): python-paths covers the shell wrappers python-suite tests (#16249) #16892 fix(ci): python-paths covers the shell wrappers python-suite tests (python-paths: a change to only check-pre-commit-hook-pr.sh skips the tests that exercise it #16249)
• security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (#16457) #16891 security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (security(websocket): auth token travels in the URL query string, not a header/subprotocol #16457)
• fix(ci): give the SLM backend's tests their own venv in CI (#16394) #16889 fix(ci): give the SLM backend's tests their own venv in CI (ci: run SLM backend tests in their own venv, so CI stops forcing the backend's websockets<16 cap onto the SLM #16394)
• fix(hooks): the non-git guards tell invoking a command from naming one (#14144) #16885 fix(hooks): the non-git guards tell invoking a command from naming one (bug(hooks): push guard matches the branch name in argv, so 5 forms reach the protected base unblocked #14144)
• security(infra): stop binding ChromaDB to every interface by default (#15317) #16882 security(infra): stop binding ChromaDB to every interface by default (security(chromadb): the vector store binds every interface in front of four unpatchable advisories, one a pre-auth RCE #15317)
• fix(slm-backend): retain the last five discarded background-task launches (#15524) #16880 fix(slm-backend): retain the last five discarded background-task launches (Discarded asyncio.create_task calls can be garbage-collected mid-flight (12 sites) #15524)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[mrveiss]

Carried by vehicle #17086, which includes this PR's approved head 0e98aa2f6. Closed now as carried, per the owner's ruling (2026-09-19) that consolidated work shouldn't keep open duplicates or trigger extra CI. The branch is kept. The vehicle's own Closes lines close the linked issues when it lands. If #17086 is abandoned, this PR gets reopened.