fix(linux): surface provider-scoped rate windows and drop unmeasured ones

[jsonMartin]

Linux and Omarchy dropped measured provider-specific quota windows and could show synthetic or unmeasured windows as full or exhausted quota. This change appends measured scoped windows after the standard windows, rejects unusable entries, and preserves existing fractional-day labels.

Scoped windows require stable, nonempty IDs. Their internal notification keys have a separate namespace, preventing collisions with standard quota and status state. IPC exports opaque keys that remain stable for the backend process, and email-bearing titles stay redacted regardless of the native identity-display preference. Standard window keys are unchanged.

Validation:

• 25 Node model/notification tests, including missing IDs, reordering, alert collisions, redaction, and copied summaries.
• 15 native Qt runtime tests and three Qt account-action checks on isolated Linux with synthetic HOME/XDG and a fake CLI.
• The baseline failed the phantom-session/scoped-window regression; the original PR failed the native privacy assertion; the final implementation passed both.
• A freshly built Qt archive was installed and launched for before/after screenshots. Narrow-window wrapping and scrolling were exercised and inspected.
• make check and independent review through P2 passed.

Thanks @jsonMartin for the original fix and the Omarchy 4.0.3 / CodexBar CLI 0.61.0 reproduction. Maintainer runtime proof uses synthetic data and no real provider credentials. Before/after images are attached in the proof comment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 20, 2026, 9:13 PM ET / September 21, 2026, 01:13 UTC (Revision 6).

ClawSweeper review

What this changes

The Linux desktop and Omarchy integration display measured provider-specific quota windows, omit synthetic or unmeasured windows, and protect scoped identifiers in exported snapshots.

Merge readiness

✅ Ready for maintainer review

This PR remains useful: main and v0.63.0 still omit scoped quota windows and display synthetic placeholders. The revised patch has convincing native before/after proof and no actionable correctness findings.

Priority: P2
Reviewed head: a0a2601b18186fbfeaf4c7e22e2c78028312b5a3

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with strong native visual proof and targeted regression coverage; no blocking defect was identified.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (screenshot): The exact-head maintainer proof exercises the rebuilt and installed Qt application through synthetic CLI usage data, showing the corrected quota cards, wrapping, and scrolling. Native snapshot coverage supplements the visual proof for identifier privacy.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (screenshot): The exact-head maintainer proof exercises the rebuilt and installed Qt application through synthetic CLI usage data, showing the corrected quota cards, wrapping, and scrolling. Native snapshot coverage supplements the visual proof for identifier privacy.
Evidence reviewed	6 items	Pinned introduced change: Read all eight introduced file diffs between the pinned main and PR head; production changes are confined to quota projection and snapshot key privacy. Still necessary on main and latest release: Both inspected versions project only primary, secondary, and tertiary windows and lack the synthetic-placeholder filter. The related open bar-formatting proposal builds on this work rather than replacing it. Existing producer contract: RateWindow documents synthetic sessions as absent quota lanes; NamedRateWindow documents usageKnown=false as unsuitable for quota percentages. The patch consumes these existing fields without changing provider configuration.
Findings	None	None.
Security	None	None.

How this fits together

The Linux desktop converts CodexBar CLI usage JSON into quota cards, notifications, and private IPC snapshots. Omarchy reads those snapshots to display the same usage data.

flowchart TD
 A[CLI usage JSON] --> B[Shared quota model]
 B --> C[Filter unmeasured windows]
 C --> D[Native quota cards]
 C --> E[Notification transitions]
 C --> F[Private IPC snapshot]
 F --> G[Omarchy display]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +39/-3; tests +132/-2	Production growth is justified by measured-window projection and IPC privacy, with focused model and native regression coverage.

Technical review

Best possible solution:

Keep one shared quota projection that honors the CLI’s measurement flags, preserves general-window ordering, and exports private scoped identities.

Do we have a high-confidence way to reproduce the issue?

Yes: main’s projection ignores extraRateWindows and treats a synthetic zero-used session as full remaining quota. The supplied native before/after evidence corroborates that path; this review did not execute it.

Is this the best way to solve the issue?

Yes: extending the existing shared model is the narrowest repair, and the patch preserves standard keys, fractional cadence labels, and stored preferences.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cae98134ef95.

Labels

Label changes:

• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The exact-head maintainer proof exercises the rebuilt and installed Qt application through synthetic CLI usage data, showing the corrected quota cards, wrapping, and scrolling. Native snapshot coverage supplements the visual proof for identifier privacy.

Label justifications:

• P2: This repairs misleading or missing Linux quota information with a bounded desktop and adapter impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The exact-head maintainer proof exercises the rebuilt and installed Qt application through synthetic CLI usage data, showing the corrected quota cards, wrapping, and scrolling. Native snapshot coverage supplements the visual proof for identifier privacy.
• proof: sufficient: Contributor real behavior proof is sufficient. The exact-head maintainer proof exercises the rebuilt and installed Qt application through synthetic CLI usage data, showing the corrected quota cards, wrapping, and scrolling. Native snapshot coverage supplements the visual proof for identifier privacy.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The exact-head maintainer proof exercises the rebuilt and installed Qt application through synthetic CLI usage data, showing the corrected quota cards, wrapping, and scrolling. Native snapshot coverage supplements the visual proof for identifier privacy.

Evidence

What I checked:

• Pinned introduced change: Read all eight introduced file diffs between the pinned main and PR head; production changes are confined to quota projection and snapshot key privacy. (Integrations/Linux/Shared/Usage.js:2, a0a2601b1818)
• Still necessary on main and latest release: Both inspected versions project only primary, secondary, and tertiary windows and lack the synthetic-placeholder filter. The related open bar-formatting proposal builds on this work rather than replacing it. (Integrations/Linux/Shared/Usage.js:2, f3e718c897d5)
• Existing producer contract: RateWindow documents synthetic sessions as absent quota lanes; NamedRateWindow documents usageKnown=false as unsuitable for quota percentages. The patch consumes these existing fields without changing provider configuration. (Sources/CodexBarCore/UsageFetcher.swift:98, a0a2601b1818)
• Native proof for the revised head: Supplemental live comment fix(linux): surface provider-scoped rate windows and drop unmeasured ones #3785 (comment) explicitly identifies the reviewed head and a rebuilt, installed Qt candidate using synthetic data. Inspected all four attached images: the phantom 100% session disappears, the general weekly quota remains first, the scoped cap shows 7%, and wrapping and scrolling expose later caps. This comment supplements the supplied snapshot; it does not replace its captured body. (a0a2601b1818)
• Privacy and regression coverage: Scoped notification keys are namespaced; snapshot keys are salted hashes stable within the process. Added native coverage checks email-bearing IDs and titles with identity display enabled, while model tests cover invalid IDs, ordering, unknown usage, collisions, and copied summaries. No tests or builds were executed during this read-only review. (Integrations/Linux/tests/test_desktop.py:104, a0a2601b1818)
• Feature-history routing: Main-branch history identifies Peter Steinberger across the shared-backend introduction and later display-preference work; GitHub maps the latter commit to steipete. Exact blame and comparison with the earlier reviewed head were unavailable because required objects could not be read, so no source-line introduction or late-finding attribution is asserted. (Integrations/Linux/Shared/Usage.js, 213093a73903)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-09-20T20:10:36.677Z sha bd42b31 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-20T21:40:51.308Z sha bd42b31 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-20T22:00:33.168Z sha bd42b31 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-20T22:25:35.880Z sha bd42b31 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-20T22:54:33.579Z sha bd42b31 :: needs maintainer review before merge. :: none

[jsonMartin]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[steipete]

Maintainer native proof for a0a2601. All data is synthetic. The production Qt app was rebuilt for the baseline and candidate; the candidate archive was installed before launch.

The baseline renders a synthetic session as 100% remaining and omits the measured model cap. The candidate removes that placeholder, keeps the general weekly window first, and shows the measured 7%-remaining scoped cap. A long label wraps at narrow width, and every bounded extra remains reachable by scrolling.

The native snapshot regression also verifies that email-bearing IDs and titles stay private with identity display enabled. Notification tests cover IDs that collide with standard windows or status.

Before:

After:

Narrow window and scrolling:

[steipete]

Merged as 9d3f6bf. Thanks @jsonMartin!

The maintained candidate passed node --test Integrations/Omarchy/test.mjs Integrations/Omarchy/notifications.test.mjs (25 tests), python3 Integrations/Linux/tests/test_desktop.py against the built Qt app (15 native runtime tests), and the Qt account-action test binary (3 checks). make check and independent review through P2 passed.

Native proof used Ubuntu 26.04, Qt 6.10.2 and Node 26.9.0 with synthetic HOME/XDG directories and a fake provider CLI. The production Qt archive was packaged, installed and launched. Baseline regressions demonstrated the phantom full session and missing model cap; the contributor candidate also exposed raw scoped IDs in snapshots, which the final patch protects. Narrow layout, scrolling, notification collisions, reordering and identity redaction were checked. Before/after screenshots and details are above.

Exact-head general CI and Linux desktop CI passed, including both macOS shards and Linux x86-64/ARM64. The musl job was skipped by the normal path gate. Canonical main is synchronized and clean; task-owned proof machines were released.