fix(gui): providers overview quota/auth, Claude pool toggle, combos/models layout, dev session bootstrap - #988
Merged
Conversation
…v session bootstrap Removes the doctor-copy affordance from embedded Providers account surfaces, adds quota bars plus a compact logged-in summary to the provider Overview, converts the Claude pool Off/On text toggle into a real knob, and tightens warning-banner padding. Models/Combos: reserve silent height struts so late /api/combos and v2 status cannot shift the page, drop the bordered loading placeholder and status row, normalize combo typography onto design tokens, and wrap long helper copy. Dashboard: give .tbl a top inset without breaking the sticky header, and raise .pws-capacity-incomplete contrast to WCAG AA on both themes. Dev GUI: bootstrap loopback sessions through a dedicated /opencodex-session path proxied with changeOrigin:false so Vite keeps the original host while the backend still mints origin-bound sessions.
The removed loading status line was a page-loading-contract surface. Combos now revalidates over existing content without a visible spinner, keeps the failure notice path, and announces the in-flight refresh to assistive tech via aria-busy on the workspace body.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughThe GUI now uses ChangesGUI workspace and authentication
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f83413da76
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@gui/src/pages/Combos.tsx`:
- Around line 250-252: Update Combos.tsx to memoize the cache read with useMemo,
pass cached ?? undefined as initialData to useDataSurface, and remove the cached
fallback from the data assignment so it uses state.data directly. Follow the
existing pattern in Models.tsx and preserve refresh state propagation through
state.refreshing.
In `@gui/tests/page-loading-contract.test.tsx`:
- Line 69: Add a focused Bun regression test in page-loading-contract.test.tsx
for Combos that renders cached data, verifies the relevant loading container
exposes aria-busy="true" during refresh, then awaits request completion and
verifies the attribute is cleared. Keep the existing failure-notice assertion
unchanged, and target the loading behavior implemented by Combos.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8b99fccf-e87d-4a25-9828-0c8b3f2c4fb0
📒 Files selected for processing (20)
gui/src/api.tsgui/src/components/CodexAccountPool.tsxgui/src/components/combo-workspace-add-modal.tsxgui/src/components/combo-workspace-detail-panel.tsxgui/src/components/provider-workspace/AnthropicAccountPoolSettings.tsxgui/src/components/provider-workspace/ProviderAuthPanel.tsxgui/src/components/provider-workspace/ProviderDetails.tsxgui/src/components/provider-workspace/ProviderOverview.tsxgui/src/pages/Combos.tsxgui/src/pages/Models.tsxgui/src/styles-combos-workspace.cssgui/src/styles-dashboard-workspace.cssgui/src/styles-models-workspace.cssgui/src/styles/provider-overview-dashboard.cssgui/tests/api-auth-memory.test.tsgui/tests/codex-account-pool-controller.test.tsgui/tests/page-loading-contract.test.tsxgui/vite.config.tstests/provider-workspace-auth.test.tstests/server-management-auth.test.ts
💤 Files with no reviewable changes (1)
- gui/src/components/provider-workspace/ProviderAuthPanel.tsx
…n bootstrap - Models: reserve only the sub-agent mode row while /api/v2 loads; the conditional threads row no longer reserves height that vanishes on the default disabled install. - Provider overview: reuse ProviderCapacityQuota (shared with the aggregate dashboard) so pooled Codex capacity keeps estimate, recovery, current-account, and incomplete-window warnings instead of collapsing to a plain rate-limit bar. - Dev session bootstrap: serve /opencodex-session from a dedicated minimal document independent of gui/dist, so a fresh Vite checkout mints an origin-bound loopback session without a packaged GUI build.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/server/gui-static.ts`:
- Around line 84-98: Refactor serveSessionBootstrap and htmlResponse to reuse
shared helpers for session bootstrap metadata and response headers. Extract the
duplicated metadata construction and header configuration into focused helpers,
then have both response paths call them while preserving the existing HTML,
caching, and browser security-header behavior.
- Around line 84-90: Update serveSessionBootstrap to HTML-attribute-escape
session.token, session.csrfToken, and session.origin before interpolating them
into the meta tags. Add one shared encoder for &, ", <, and >, and apply it
consistently to all three fields while preserving the existing response
structure.
- Around line 84-90: Update serveSessionBootstrap so it no longer embeds
session.token or session.csrfToken in HTML. Generate a one-time bootstrap
handle, expose only that handle to the GUI, and add the server-side exchange
that atomically consumes it to set an HttpOnly, SameSite session cookie; retain
CSRF protection through server-side validation rather than client-readable
credentials.
In `@tests/server-management-auth.test.ts`:
- Around line 384-390: Add a new integration test that uses startServer(0) to
fetch GET /opencodex-session from a live server instance instead of calling
serveSessionBootstrap directly as a unit test. In this integration test, assert
the HTTP response has status 200, Content-Type header is text/html,
Cache-Control is no-store, Pragma is no-cache, X-Frame-Options is DENY,
Content-Security-Policy contains frame-ancestors 'none', and the response body
contains all three metadata fields: opencodex-session-token,
opencodex-session-csrf, and opencodex-session-origin. Keep the existing unit
test that calls serveSessionBootstrap directly as a separate test to maintain
focused regression coverage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7683646b-696b-4f6b-adfa-73683b2ab0c8
📒 Files selected for processing (7)
gui/src/components/provider-workspace/ProviderCapacityQuota.tsxgui/src/components/provider-workspace/ProviderOverview.tsxgui/src/components/provider-workspace/ProviderOverviewDashboard.tsxgui/src/pages/Models.tsxsrc/server/gui-static.tssrc/server/index.tstests/server-management-auth.test.ts
Combos now passes the session-cache seed into useDataSurface as initialData (the Models pattern), so a cold load over cached content reports refreshing=true and the workspace body keeps aria-busy announced while revalidating. Adds a focused regression test asserting aria-busy=true during the gated refresh and false after it settles.
… route with an integration test htmlResponse and serveSessionBootstrap now use one escaped meta-tag builder and one HTML document response, so token/csrf/origin cannot become attribute markup and the two paths cannot drift. Adds a live-server test that GETs /opencodex-session and asserts status, cache/security headers, and all three session meta fields.
Collaborator
Author
|
Ready to merge @lidge-jun |
…ble toggle name, token cleanup - Combos/Models: aria-busy alone does not announce; add an sr-only role=status live region carrying common.loading in both shells, and pin the contract in page-loading-contract.test.tsx - Claude pool toggle: stable accessible name (anthropicPool.title); aria-pressed carries state - provider-overview capacity warning uses var(--amber) (6.26:1/9.65:1); 72ch -> var(--prose-measure); 48px -> var(--space-12); refresh stale status-strip comment
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
bun run typecheck— passbun run lint:gui— passbun run build:gui— passbun test tests(GUI suite) — 583 pass / 0 failbun test tests/provider-workspace-auth.test.ts tests/server-management-auth.test.ts— 34 pass / 0 fail (with OPENCODEX_ACL_TIMEOUT_MS=15000)bun run test(root suite) — 8142 pass / 7 skip / 21 fail; the 21 failures reproduce identically on a clean upstream/dev checkout on this machine (Windows symlink/ACL and temp-lock EBUSY suites), so they are not introduced by this diff.Review notes
Limitations
Summary by CodeRabbit
New Features
Bug Fixes
Style & Accessibility