fix(codex): suppress false session restore when resetsAt is unchanged - #2060
Conversation
Apply the same session reset-boundary guard used by confetti detection to OS session quota notifications, so transient Codex usedPercent=0 samples no longer post a restored notification before the window actually resets. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: de7a0024ed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| currentResetBoundary: Date?) -> Bool | ||
| { | ||
| guard let previousResetBoundary else { return true } | ||
| guard let currentResetBoundary else { return false } |
There was a problem hiding this comment.
When Codex auto falls back from OAuth data that had a future reset timestamp to CLI/RPC data that omits resetsAt after that cached reset has passed, this nil current boundary now rejects the real depleted -> available transition. Since handleSessionQuotaTransition preserves the depleted baseline on a rejected restore, subsequent positive samples with no boundary are rejected the same way, so the user never gets the restored notification even though quota is usable again.
Useful? React with 👍 / 👎.
|
Codex review: needs real behavior proof before merge. Reviewed July 11, 2026, 3:02 PM ET / 19:02 UTC. Summary Reproducibility: yes. at source level: record a later future boundary for depleted account A, activate account B with an earlier valid boundary, then restore B before A’s boundary elapses. The provider-scoped monotonic guard rejects B’s boundary as regressed. Review metrics: 3 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Security Review findings
Review detailsBest possible solution: Session notification state should remain monotonic within one account while being cleared or keyed by stable account identity across account changes, with focused coverage and redacted real-setup proof of both suppressed false restores and delivered legitimate restores. Do we have a high-confidence way to reproduce the issue? Yes at source level: record a later future boundary for depleted account A, activate account B with an earlier valid boundary, then restore B before A’s boundary elapses. The provider-scoped monotonic guard rejects B’s boundary as regressed. Is this the best way to solve the issue? No, not yet. Reset-boundary gating is the narrow correct mechanism for transient samples, but its lifecycle must be made account-safe before merge. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 0bb874930d6a. Label changesLabel changes:
Label justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (5 earlier review cycles)
|
clawsweeper
Bot
added
proof: sufficient
…tsAt When Codex falls back to CLI/RPC samples that omit resetsAt after a previously known session boundary has passed, allow the restored notification instead of preserving the depleted baseline forever. Add regression coverage for the repeated fallback sequence. Co-authored-by: Cursor <cursoragent@cursor.com>
clawsweeper
Bot
added
rating: 🐚 platinum hermit
# Conflicts: # Sources/CodexBar/Providers/Codex/UsageStore+CodexAccountState.swift # Sources/CodexBar/UsageStore+OpenAIWeb.swift
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3d20558056
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| guard previousBoundary == nil || | ||
| UsageStore.limitResetBoundaryAdvanced(previous: previousBoundary, current: resetBoundary) |
There was a problem hiding this comment.
When the active token account changes, a valid reset time for the new account can be earlier than the previous account's boundary; because this provider-scoped guard treats that as a regression and keeps the old boundary, subsequent depleted -> available samples for the new account can be suppressed until the old account's reset time. The token-account switch path (setActiveTokenAccountIndex → activateCachedTokenAccountSnapshot) does not clear this new boundary state, so the boundary needs to be account-scoped or reset on account activation before rejecting earlier values.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🦞 diamond lobster
# Conflicts: # CHANGELOG.md
clawsweeper
Bot
added
rating: 🦐 gold shrimp
clawsweeper
Bot
added
status: 📣 needs proof
2 participants
Summary
usedPercent = 0whileresetsAtis unchanged) from posting a false "session restored" notification.resetsAtto restore only after the previously known boundary has elapsed.Related to #2054, but scoped separately from weekly confetti work in #2056.
Test plan
swift test --filter 'CodexSessionQuotaFalseRestoreTests|SessionQuotaNotificationLogicTests'(22 tests)make checkmake test(611 selections, 51 groups, 0 failures or retries)autoreview --mode branch --base origin/main(clean, no actionable findings)make checkand focused fix(codex): suppress false session restore when resetsAt is unchanged #2060/perf: match cost history fingerprint to visible content #2067 interaction suite (47 tests)Made with Cursor