[yordis]

Problem

A usage-limit source's management key still has to be pasted into T3 Code, so teams that keep credentials in 1Password cannot read it from there.

Change

• The management key of a usage-limit source accepts a secret reference as well as a literal, picked with the existing source input in the add-source dialog.
• A reference is stored as written and shown as written to clients; a literal still goes to the secret store.
• The server reads the reference through the settings secret resolver when it queries the source, and reloading secrets re-reads it. If the provider cannot read it, the source reports that the key could not be read from its secret provider rather than querying with an empty key.
• Older clients decode secret fields as plain strings, so one saved reference made them fail to decode the whole server config. Clients now send clientCapabilities=settingsSecretReferences on the socket URL. A client that does not send it sees each reference as a saved secret, and when it saves that back, the server keeps the reference.

Scope and approval

Builds on https://git.cafe/pingdotgg/t3code/pulls/27746 and https://git.cafe/pingdotgg/t3code/pulls/27756, both merged, reusing SecretResolver and SecretSourceInput unchanged and gated by the same secrets feature flag. It adds no provider kind and no new setting.

Verification

• vp test run on UsageLimitSources.test.ts and sourceControlHostSecrets.test.ts: pass. Covers reading a key from a reference, the clear failure when the provider cannot read it, and invalidation on reload.
• vp run typecheck and vp run check:changed: pass.
• serverSettings.test.ts checks what an older client sees and that its save keeps every reference. It fails with either the conversion or the restore removed. A second test lists every strictly decoded field that can hold a reference (usageLimitSources.*.managementKey), so a new one fails until the older-client case covers it.
• Not checked: a live 1Password account, or a released older client against this server.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

This change lacks the UI evidence required by verification. AddUsageLimitSourceDialog replaces the management-key input with SecretSourceInput, but the PR supplies no before/after screenshots of that dialog or recording of choosing a reference and saving it. The focused resolver tests and parent source-control-host captures do not demonstrate the changed usage-source flow. Please attach matching dialog captures and a short recording of selection, save and the resulting source status, report the lookup check and any live-provider limits, and request reconsideration. Reusing an established secret-resolver capability does not remove this evidence requirement.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Reopening. An automated triage pass closed this by mistake; the closing comment above does not apply. Sorry for the noise.

[macroscopeapp]

Approvability

Verdict: Approved at c0c5309

Macroscope's review found this PR approvable — Adds optional secret-provider references for usage-limit management keys while retaining literal-key behavior. Resolution failures stop requests, and compatibility handling preserves saved references for older clients.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: afae755
• Latest commit, not reviewed: c0c5309

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

Walkthrough

Usage-limit management keys now accept secret references. The server resolves keys before CliproxyHub API calls and includes referenced keys in settings-secret invalidation during provider refresh.

Changes: Usage-limit secret management

Layer / File(s)	Summary
Configure management keys as secrets packages/contracts/src/settings.ts, apps/web/src/components/settings/SecretSourceInput.tsx, apps/web/src/components/settings/SecretSourceInput.browser.test.tsx, apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx	The settings schema accepts secret values for management keys. The dialog accepts text or a selected secret reference. SecretSourceInput calls callbacks when a provider is selected or a reference is rejected.
Resolve keys for CliproxyHub requests apps/server/src/usage/UsageLimitSources.ts, apps/server/src/usage/cliproxyApi.ts, apps/server/src/usage/UsageLimitSources.test.ts	UsageLimitSources resolves management keys before account reads and reset-credit operations. CliproxyHub API calls receive the URL and resolved key. Tests cover resolved and unreadable references.
Invalidate referenced keys during refresh apps/server/src/sourceControl/sourceControlHostSecrets.ts, apps/server/src/sourceControl/sourceControlHostSecrets.test.ts, apps/server/src/ws.ts	Settings-secret invalidation includes referenced usage-limit management keys and excludes literal keys. Provider refresh invokes invalidation and usage-limit source refresh for full-server requests.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant UsageLimitSources
  participant SecretResolver
  participant CliproxyHub
  UsageLimitSources->>SecretResolver: Resolve management key
  SecretResolver-->>UsageLimitSources: Return resolved key or read error
  UsageLimitSources->>CliproxyHub: Send URL and resolved key

Loading

Suggested reviewers: maria-rcks

Merge Risk: Low · previous review afae7

A rejected edit can prevent users from clearing an existing provider-backed key, leaving an unintended credential configured in the source.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description includes all required headings and explains the problem, implementation, scope, tests, results, and limitations. It does not include the required before-and-after screenshots for the U…	Add before-and-after screenshots and a short recording demonstrating the changed usage-limit source flow. Include the lookup check and live-provider limitations. Add a link to the triaged issue or discussion with the explicit maintainer app…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: usage-limit source keys can be read from a secret provider.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes all required headings and explains the problem, implementation, scope, tests, results, and limitations. It does not include the required before-and-after screenshots for the UI change or the requested recording of reference selection, saving, and resulting source status. The scope section links related pull requests but does not include an explicit maintainer approval comment or explain why the change qualifies for an exemption.

Resolution

Add before-and-after screenshots and a short recording demonstrating the changed usage-limit source flow. Include the lookup check and live-provider limitations. Add a link to the triaged issue or discussion with the explicit maintainer approval comment, or explain why the change qualifies as a focused obvious fix without prior approval.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: a036489
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: a4d26fe1-7a03-4183-b7cc-861ee64f17b5

Commits

Reviewing files that changed from the base of the PR and between 14c87d3 and afae755.

Files selected for processing: 2

• apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
• apps/web/src/components/settings/SecretSourceInput.tsx

Limit details: You’ve used all 10 included reviews currently available.

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

Dismissing prior approval to re-evaluate cfa8459

Dismissing prior approval to re-evaluate 14c87d3

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

verified the reachable Linux web flows at 8d017b6b429ab866747cc222c94570d134055c54, with the limits below. used repo Playwright and /usr/bin/google-chrome, one background dev server at a time, isolated state, and projects/threads created through the app. no mocks, seeded fixtures, or replay provider.

• reproduced the missing source picker on github/main (71646e031a). added a 1password provider through settings; main still offered only a literal management key.
• on the pr, selected a provider, entered a valid reference, edited it to invalid text, corrected it, and saved. found and fixed the invalid edit switching to a literal input and hiding its error. the reference now remains editable, and saving is disabled until corrected.
• checked the neighboring provider-variable flow: valid reference, invalid edit, then clear. clearing removes the reference. the fix preserves existing callers' clearing behavior.
• saved reference settings remain {provider, reference} across a server restart. the running server's actual resolver reports Could not read the management key from its secret provider. in limits when op is unavailable. provider refresh completes and repeats this error.
• literal keys still use secret storage, with only •••••• persisted in settings. the literal source reaches the network request path and reports ECONNREFUSED for the deliberately unserved local hub address.
• real Codex gpt-6.1-sol turns completed through the web client on main and the pr, including after the final fix: verification main ok. and final verification ok.

both regression assertions failed before their fixes. the final existing browser file passes all 3 cases on blacksmith. blacksmith-check running vp run check:changed github/main passed format, lint, knip, graphql, affected typechecks (35 packages), 77 tests in 8 files, and react compiler checks. two independent read-only reviews found no remaining code findings at this head.

before, main with the provider configured:

after, matching dialog data with the source picker:

selection, invalid edit, correction, save, and actual source status:

Not verified

• successful 1password reads and key rotation: the vm has no op executable or signed-in 1password account. the account and reference entered for the failure scenario are intentionally unconfigured. reload was exercised, but successful cache invalidation after rotation was not.
• successful hub quota reads, authorization with a resolved key, and reset-credit consumption: no real hub or management credential was available. an ordinary Codex turn does not prove these operations.
• native iOS/Android, desktop shell, macOS/Windows, and remote relay/tunnel connections were not exercised on this Linux vm.
• native Codex quota retrieval through this machine's local proxy returns JSON-RPC -32600; quota success is unverified even though real turns succeed.

captures were inspected, and uploaded video playback and seeking were checked in Chrome. work used gpt-6.1-sol through the Codex harness.

[yordis]

Thanks for the verification. The head 8d017b6b42 includes the invalid-edit fix and the provider-variable clear fix (afae75511e, 8d017b6b42), the usage-limit key is covered by the existing invalidation test (14c87d359e), and every review thread now has a reply with its commit. The live 1Password and hub reads you list as unverified need credentials I do not have either.

Dismissing prior approval to re-evaluate 855d98f

Dismissing prior approval to re-evaluate 888a4d7

Dismissing prior approval to re-evaluate c0c5309