Protect critical usage boundary behavior - #246
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ceiling | 51c4e9d | Commit Preview URL Branch Preview URL |
Aug 09 2026, 02:30 PM |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe PR updates quota run finalization, adds multi-domain cookie lookup fallback, expands usage pace coverage, and makes Claude OAuth expiry checks deterministic through an explicit-time helper. ChangesQuota run history
Cookie domain fallback
Usage pace coverage
OAuth expiry evaluation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
acf17b1 to
a86c748
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
apps/desktop-tauri/src-tauri/src/quota_run_history.rs (1)
208-222: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftProcess classified capacity events before recording the snapshot.
When one sample causes both an observed drop and a classified reset event,
record_snapshotcloses the existing run and opens a new run beforerecord_capacity_eventsprocesses the event. The event then finalizes that new run withevent.previous_used_percent, creating a spurious second run with zero duration. Add a regression test for this production call order.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/desktop-tauri/src-tauri/src/quota_run_history.rs` around lines 208 - 222, Update record_snapshot and record_capacity_events so classified capacity events are processed before the snapshot-driven observed-drop finalization, preventing the event from closing the newly opened run with event.previous_used_percent. Add a regression test covering the production call order where one sample contains both an observed drop and a classified reset event, and assert no spurious zero-duration second run is created.rust/src/browser/cookies.rs (1)
716-733: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRoute Claude cookie lookup through this selector.
rust/src/providers/claude/web_api.rslines 263-283 still loops overget_cookie_headerdirectly and discards everyCookieError. If an App-Bound Encryption error occurs and no domain returns a header, that runtime path returnsProviderError::NoCookiesinstead of the actionable ABE error preserved here.Use
browser_cookie_header(&domains)orget_cookie_header_for_domains(&domains)in that path. This keeps domain fallback and error selection consistent.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@rust/src/browser/cookies.rs` around lines 716 - 733, Update the Claude cookie lookup path in the web API flow to call browser_cookie_header or get_cookie_header_for_domains with the domain list instead of looping over get_cookie_header directly. Preserve domain fallback while propagating the selector’s chosen CookieError, including AppBoundEncryption, rather than converting all failures to ProviderError::NoCookies.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@rust/src/providers/claude/oauth/mod.rs`:
- Around line 457-473: Add an exact five-minute boundary assertion in
token_expiry_honors_the_five_minute_refresh_skew, setting expires_at to now +
ChronoDuration::minutes(5) and asserting credentials.is_expired_at(now) is true.
Keep the existing six-minute, one-minute, past-expiry, and missing-expiry cases
unchanged.
---
Outside diff comments:
In `@apps/desktop-tauri/src-tauri/src/quota_run_history.rs`:
- Around line 208-222: Update record_snapshot and record_capacity_events so
classified capacity events are processed before the snapshot-driven
observed-drop finalization, preventing the event from closing the newly opened
run with event.previous_used_percent. Add a regression test covering the
production call order where one sample contains both an observed drop and a
classified reset event, and assert no spurious zero-duration second run is
created.
In `@rust/src/browser/cookies.rs`:
- Around line 716-733: Update the Claude cookie lookup path in the web API flow
to call browser_cookie_header or get_cookie_header_for_domains with the domain
list instead of looping over get_cookie_header directly. Preserve domain
fallback while propagating the selector’s chosen CookieError, including
AppBoundEncryption, rather than converting all failures to
ProviderError::NoCookies.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e80b00f0-7866-491a-807b-9913f2ba09cc
📒 Files selected for processing (4)
apps/desktop-tauri/src-tauri/src/quota_run_history.rsrust/src/browser/cookies.rsrust/src/core/usage_pace.rsrust/src/providers/claude/oauth/mod.rs
1 participant
Summary
Closes SBS-641.
Closes SBS-643.
Closes SBS-646.
Closes SBS-647.
Validation
cargo test --manifest-path rust/Cargo.toml(859 library tests, CLI test, and doc tests passed)cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml(483 passed)cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warningscargo clippy --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml --all-targets -- -D warningscargo fmt --all --manifest-path rust/Cargo.tomlgit diff --checkSummary by CodeRabbit