Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

src/Lang/Lang.php (1)

61-64: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

getTranslation return type could be string instead of ?string.

The adapter's get() always returns string (either the translation or the key itself), so ?string is overly permissive. Tightening this to string would give callers a more precise contract.

🔧 Suggested refinement

-    public function getTranslation(string $key, array|string $params = null): ?string
+    public function getTranslation(string $key, array|string $params = null): string

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/Lang/Lang.php` around lines 61 - 64, Update the return type of
Lang::getTranslation from ?string to string to match the adapter->get contract,
while preserving the existing delegation and parameters.

src/Lang/Adapters/FileAdapter.php (1)

88-100: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

Consider using !== null instead of truthiness for $params check.

Line 96 uses return $params ? _message($message, $params) : $message;. A string param of '0' or an empty array [] would be falsy and skip interpolation. While [] correctly means "no params," the '0' edge case is surprising. Using $params !== null would be more precise and avoid the '0' pitfall.

♻️ Suggested refinement

-        return $params ? _message($message, $params) : $message;
+        return $params !== null ? _message($message, $params) : $message;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/Lang/Adapters/FileAdapter.php` around lines 88 - 100, Update the
parameter check in FileAdapter::get to use an explicit null comparison, ensuring
a string value of "0" still reaches _message while null skips interpolation;
preserve the existing translation lookup and fallback behavior.

src/Lang/Adapters/GoogleTranslateAdapter.php (1)

65-81: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Move API key from URL query parameter to x-goog-api-key header.

The API key is currently embedded in the request URL via http_build_query($query), exposing it in proxy logs, access logs, and any HttpClient URL logging. Google Cloud APIs support the x-goog-api-key header as a more secure alternative.

🔒 Proposed fix

 $query = [
     'q' => $text,
     'target' => $this->lang,
     'format' => 'text',
-    'key' => $apiKey,
 ];
 
 if (!empty($this->params['source_locale'])) {
     $query['source'] = (string) $this->params['source_locale'];
 }
 
 $response = $this->sendRequest(
     (string) ($this->params['api_url'] ?? self::API_URL) . '?' . http_build_query($query, '', '&'),
     null,
-    [],
+    ['x-goog-api-key' => $apiKey],
     'POST'
 );

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/Lang/Adapters/GoogleTranslateAdapter.php` around lines 65 - 81, Update
the request construction in GoogleTranslateAdapter so the API key is removed
from the $query parameters and sent through the x-goog-api-key header passed to
sendRequest. Keep the remaining query parameters and POST behavior unchanged,
ensuring the key is no longer included in the URL generated by http_build_query.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

tests/Unit/Lang/LangTest.php (1)

54-61: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider renaming testLangFlushResetsTranslations to reflect actual behavior.

After flush(), FileAdapter::get() lazily reloads translations, so the assertion is identical before and after. The test would pass even if flush() were a no-op. A name like testLangFlushDoesNotBreakTranslations or adding an assertion that verifies the cache was actually cleared (e.g., via a spy or by checking reload count) would better communicate intent.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/Unit/Lang/LangTest.php` around lines 54 - 61, The test name
testLangFlushResetsTranslations does not match its assertions, which only verify
translations remain available after flushing. Rename it to describe that flush
preserves translation access, such as testLangFlushDoesNotBreakTranslations,
without changing the test behavior.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes