ZacharyZhang-NY/Kigi-CLI
1
0
Fork 0
Code Issues Pull Requests Actions 13 Packages Projects Releases Wiki Activity

F3: Kimi inference pipeline + full grok cloud-surface excision

Browse Source 
Sampler / inference (PRD F3):
- kimi_compat.rs: single adaptation point for the Kimi chat/completions
  dialect (thinking-field mapping, model_id stripping, empty-content
  tool-call message fix, stream_options.include_usage), with kimi-cli
  source citations
- Rate-limit handling reworked for Kimi/Moonshot semantics; UA kigi/{version}
- /models replaces the xAI models-v2 endpoint everywhere; idle model
  refresh carries X-Msh-* device headers only (X-XAI-Token-Auth and
  x-grok-client-mode/CLIENT_MODE_HEADER machinery deleted)

Cloud-surface excision (PRD §5, zero-egress):
- remote/ conversations lane, cli-chat-proxy-types crate, prod/ dir,
  share command, credit bar: deleted (single local session lane;
  paginate() replaces merge_and_paginate)
- Subscription/tier gate stack deleted end-to-end: AppView
  gate/tier/team/ZDR fields, app/subscription.rs watch loop,
  dispatch/billing.rs paywall + SuperGrok upsell, free-usage-exhausted
  chain, tier-restricted commands, GateInfo, RemoteSettings gate fields,
  SettingsUpdateNotification gate fields
- /privacy + coding-data-sharing setting deleted (backed by a dead xAI
  RPC; Kigi is zero-egress — nothing to share or retain remotely)

Auth UX correctness (user-reported):
- Device-flow fixtures now mirror the live Kimi payload shape
  (https://www.kimi.com/code/authorize_device?user_code=..., verified
  against auth.kimi.com); the fabricated auth.kimi.com/device?code=...
  URLs are gone
- open_browser_detached is a no-op under cfg(test): unit tests drove
  wiremock fixture URLs into the real browser (root cause of the
  "garbage mock link" ABCD-1234 tabs)
- Welcome/pager-minimal rebrand: Grok Build -> Kigi, grok.com ->
  kimi.com, "Sign in to Grok" -> "Sign in to Kimi"
This commit is contained in:
ZacharyZhang-NY
2026-07-17 16:05:51 -04:00
parent fe1f885bb3
commit ea0ce9d15f
231 changed files with 4730 additions and 26358 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/codegen/kigi-tui/src/app/acp_handler/interactions.rs
-2
View File
@@ -80,8 +80,6 @@ pub(crate) fn handle_ask_user_question(
let cmd = match kind {
LocalQuestionKind::Fork { .. } => "/fork",
LocalQuestionKind::NewSession => "/new",
LocalQuestionKind::CreditLimitUpsell => "credit-limit upsell",
LocalQuestionKind::FreeUsageUpsell => "SuperGrok upsell",
LocalQuestionKind::AgentTypeMismatch { .. } => "model switch",
LocalQuestionKind::ProjectSelect { .. } => "project select",
};
crates/codegen/kigi-tui/src/app/acp_handler/mod.rs
-2
View File
@@ -67,8 +67,6 @@ use prompt_origin::{push_wake_end_marker, viewer_turn_anchor, wake_turn_elapsed}
pub(crate) use subagent_activity::finalize_killed_subagent;
use subagent_activity::{subagent_activity_label, sync_subagent_activity};
#[cfg(test)]
pub(crate) use session_notification::apply_session_event_for_test;
use session_notification::{
advance_reconnect_cursor, confirm_context_used, detect_plan_mode_change,
drop_unexpected_replay, handle_session_notification,
crates/codegen/kigi-tui/src/app/acp_handler/session_notification.rs
+3 -30
View File
@@ -342,8 +342,6 @@ pub(super) fn handle_session_notification(notif: &acp::ExtNotification, app: &mu
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
bg_tasks: std::collections::BTreeMap::new(),
bg_tool_call_to_task: std::collections::HashMap::new(),
scheduled_tasks: std::collections::HashMap::new(),
@@ -363,7 +361,6 @@ pub(super) fn handle_session_notification(notif: &acp::ExtNotification, app: &mu
child_view.set_input_mode(InputMode::Vim);
child_view.is_subagent_view = true;
child_view.active_pane = crate::views::agent::ActivePane::Scrollback;
child_view.set_sharing_enabled(agent.sharing_enabled);
let usage_visible = agent
.prompt
.slash_controller
@@ -1087,18 +1084,6 @@ pub(super) fn handle_child_session_notification(
/// Apply a compaction or retry event to a session's activity state and scrollback.
///
/// Shared between the root agent and child (subagent) notification paths.
/// Test-only shim so dispatch-level tests can replay real notification
/// sequences (e.g. `RetryState::Retrying` → `Exhausted`) through the
/// production handler — the Retrying arm clears the `in_flight_prompt`
/// rewind stash, which a fixture setting fields directly would miss.
#[cfg(test)]
pub(crate) fn apply_session_event_for_test(
update: &XaiSessionUpdate,
session: &mut AgentSession,
scrollback: &mut crate::scrollback::state::ScrollbackState,
) -> bool {
apply_session_event(update, session, scrollback, false)
}
pub(super) fn apply_session_event(
update: &XaiSessionUpdate,
session: &mut AgentSession,
@@ -1215,7 +1200,6 @@ pub(super) fn apply_retry_state(
scrollback: &mut crate::scrollback::state::ScrollbackState,
is_api_key_auth: bool,
) {
let mut is_credit_limit = false;
let mut is_reauth = false;
use kigi_shell::extensions::notification::RetryState;
match retry {
@@ -1238,14 +1222,7 @@ pub(super) fn apply_retry_state(
session.set_retry_activity(None);
session.rate_limited = *rate_limited;
is_credit_limit = super::super::dispatch::is_credit_limit_error(None, reason);
let is_free_usage =
*rate_limited && super::super::dispatch::is_free_usage_exhausted_error(reason);
if is_credit_limit {
session.credit_limit_blocked = true;
} else if is_free_usage {
session.free_usage_blocked = true;
} else if !*rate_limited && is_reauthable_failure(None, reason) {
if !*rate_limited && is_reauthable_failure(None, reason) {
is_reauth = true;
scrollback.push_block(RenderBlock::session_event(SessionEvent::ReAuthRequired));
} else {
@@ -1268,10 +1245,7 @@ pub(super) fn apply_retry_state(
if error_type == "encrypted_content_mismatch" {
session.model_incompatible = true;
}
is_credit_limit = super::super::dispatch::is_credit_limit_error(None, message);
if is_credit_limit {
session.credit_limit_blocked = true;
} else if is_reauthable_failure(Some(error_type.as_str()), message) {
if is_reauthable_failure(Some(error_type.as_str()), message) {
is_reauth = true;
scrollback.push_block(RenderBlock::session_event(SessionEvent::ReAuthRequired));
} else if error_type == "context_length" {
@@ -1287,8 +1261,7 @@ pub(super) fn apply_retry_state(
}
}
}
if is_credit_limit {
} else if !is_reauth {
if !is_reauth {
session.in_flight_prompt = None;
}
}
crates/codegen/kigi-tui/src/app/acp_handler/settings.rs
-58
View File
@@ -107,23 +107,6 @@ pub(super) fn handle_settings_update(notif: &acp::ExtNotification, app: &mut App
if let Some(v) = update.show_resolved_model {
app.show_resolved_model = v;
}
if let Some(v) = update.sharing_enabled {
app.sharing_enabled = v;
// Propagate to existing agents so slash-command registries stay
// in sync (same fan-out pattern used when creating new agents).
for agent in app.agents.values_mut() {
agent.set_sharing_enabled(v);
}
}
// Always recompute is_api_key_auth from the tier so a later Free/SuperGrok
// stamp does not leave API-key bypass / hidden `/usage` stuck.
if let Some(v) = update.subscription_tier_display {
let is_key = super::super::app_view::is_api_key_label(&v);
app.is_api_key_auth = is_key;
app.usage_visible = !is_key && app.team_name.is_none();
app.subscription_tier = Some(v);
app.apply_tier_restrictions();
}
// TODO: extract resolve_session_picker_grouped helper (duplicates event_loop.rs:143-160)
// Respect env var > config > remote precedence (mirrors event_loop.rs startup).
if let Some(remote_val) = update.session_picker_grouped {
@@ -142,33 +125,6 @@ pub(super) fn handle_settings_update(notif: &acp::ExtNotification, app: &mut App
.unwrap_or(remote_val);
app.session_picker_grouped = resolved;
}
if let Some(v) = update.subscription_watch_interval_secs {
app.subscription_watch_interval_secs = Some(v);
}
// Gate update logic:
// - allow_access == Some(true): explicitly granted → lift the gate
// - gate_message.is_some(): server sent a new message → impose/update
// - Neither condition met: don't touch the gate. In particular,
// allow_access=Some(false) without a gate_message must NOT clear the
// gate (gate_from_settings returns None when gate_message is absent,
// which would incorrectly lift an existing gate).
if update.allow_access == Some(true) {
let effs = app.lift_gate();
app.pending_effects.extend(effs);
} else if let Some(msg) = update.gate_message.as_ref()
&& !msg.is_empty()
{
// (An empty gate_message would only clear the gate message text, NOT
// access, so it intentionally does not touch the gate here.)
let effs = app.impose_gate(kigi_shell::auth::GateInfo {
message: msg.clone(),
url: update.gate_url.clone(),
label: update.gate_label.clone(),
});
app.pending_effects.extend(effs);
}
// Load config layers once for tips + group_tool_verbs +
// collapsed_edit_blocks resolution. Loaded unconditionally: the UI flags
// re-resolve on every update (see below), and updates are rare (post-auth
@@ -361,22 +317,10 @@ pub(super) struct PagerSettingsUpdate {
#[serde(default)]
show_resolved_model: Option<bool>,
#[serde(default)]
sharing_enabled: Option<bool>,
#[serde(default)]
session_picker_grouped: Option<bool>,
#[serde(default)]
tips: Option<Vec<String>>,
#[serde(default)]
gate_message: Option<String>,
#[serde(default)]
gate_url: Option<String>,
#[serde(default)]
gate_label: Option<String>,
#[serde(default)]
allow_access: Option<bool>,
#[serde(default)]
subscription_tier_display: Option<String>,
#[serde(default)]
auto_permission_mode_enabled: Option<bool>,
/// Soft-default permission mode. Presence-aware: omit = no update,
/// `null` = recompute with remote=None, string = that soft-default.
@@ -389,8 +333,6 @@ pub(super) struct PagerSettingsUpdate {
group_tool_verbs: Option<bool>,
#[serde(default)]
collapsed_edit_blocks: Option<bool>,
#[serde(default)]
subscription_watch_interval_secs: Option<u64>,
}
/// Presence-aware string: omit → `None` (`#[serde(default)]`), null →
crates/codegen/kigi-tui/src/app/acp_handler/tests/mod.rs
-13
View File
@@ -33,8 +33,6 @@ pub(super) fn make_session(session_id: Option<&str>) -> AgentSession {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -257,17 +255,6 @@ pub(super) fn follow_ups_ext_with_prompt(
std::sync::Arc::from(serde_json::value::to_raw_value(&params).unwrap()),
)
}
pub(super) fn tier_settings_update(tier: &str) -> acp::ExtNotification {
acp::ExtNotification::new(
"x.ai/settings/update",
std::sync::Arc::from(
serde_json::value::to_raw_value(
&serde_json::json!({ "subscription_tier_display" : tier }),
)
.unwrap(),
),
)
}
pub(super) fn group_tool_verbs_settings_update(
value: Option<bool>,
) -> acp::ExtNotification {
crates/codegen/kigi-tui/src/app/acp_handler/tests/plan_mode.rs
+1 -1
View File
@@ -119,7 +119,7 @@
let agent = app.agents.get_mut(&AgentId(0)).unwrap();
seed_pending_tool(agent, "create-plan-call", "CreatePlan");
agent.active_modal = Some(crate::views::modal::ActiveModal::CommandPalette {
entries: crate::views::modal::default_palette_entries(agent.sharing_enabled),
entries: crate::views::modal::default_palette_entries(),
state: crate::views::picker::PickerState::input_active(),
window: crate::views::modal_window::ModalWindowState::new(),
});
crates/codegen/kigi-tui/src/app/acp_handler/tests/queue_and_adoption.rs
+1 -18
View File
@@ -1751,24 +1751,7 @@
}
/// The credit-limit early return discards the popped adoption's buffer.
#[test]
fn credit_limit_response_discards_adoption_buffer() {
let mut app = app_with_running_p1_and_stashed_b1();
let id = AgentId(0);
send_tool_call_update(&mut app, "b1", "bash-mode-1", None);
app.agents
.get_mut(&id)
.unwrap()
.session
.credit_limit_blocked = true;
prompt_response(&mut app, "p1");
let agent = app.agents.get(&id).unwrap();
assert!(!app.pending_running_adoptions.contains_key(&id));
assert!(agent.pending_adoption_updates.is_empty());
}
/// A stash whose pid replayed a durable terminal is discarded, never adopted.
/// A stash whose pid replayed a durable terminal is discarded, never adopted.
#[test]
fn terminal_in_replay_stash_is_discarded_not_adopted() {
let mut app = app_with_running_p1_and_stashed_b1();
crates/codegen/kigi-tui/src/app/acp_handler/tests/session_events.rs
+3 -140
View File
@@ -157,7 +157,7 @@
apply_retry_state(&exhausted, &mut session, &mut scrollback, false);
match last_session_event(&scrollback) {
Some(SessionEvent::RetryFailed { error, .. }) => {
assert_eq!(error, RATE_LIMITED_USER_MESSAGE_OAUTH);
assert_eq!(error, RATE_LIMITED_USER_MESSAGE_OAUTH.as_str());
}
other => panic!("expected OAuth rate-limit RetryFailed, got {other:?}"),
}
@@ -194,140 +194,8 @@
);
}
/// A rate-limit exhaustion whose flattened reason carries the
/// free-usage code sets both flags and pushes NO generic block (the
/// driver shows the paywall modal on PromptResponse; viewers keep no
/// marker).
#[test]
fn retry_exhausted_free_usage_sets_paywall_flag_without_marker() {
let mut session = make_session(Some("s1"));
let mut scrollback = ScrollbackState::new();
session.in_flight_prompt = Some(InFlightPrompt {
text: "try me again".into(),
images: Vec::new(),
scrollback_entry: EntryId::new(2),
chip_elements: Vec::new(),
});
apply_retry_state(
&RetryState::Exhausted {
attempts: 0,
reason: "API error (status 429 Too Many Requests): \
subscription:free-usage-exhausted: You have used all your free usage."
.into(),
is_rate_limited: true,
},
&mut session,
&mut scrollback,
false,
);
assert!(
session.rate_limited,
"free-usage keeps rate_limited (TurnFailed/toast suppression)"
);
assert!(session.free_usage_blocked);
assert_eq!(
scrollback.len(),
0,
"no RetryFailed marker — the paywall modal shows instead"
);
assert!(
session.in_flight_prompt.is_none(),
"free-usage exhaustion clears in_flight_prompt like other failures"
);
}
#[test]
fn apply_retry_state_credit_limit_exhausted_preserves_in_flight_prompt() {
let mut session = make_session(Some("s1"));
let mut scrollback = ScrollbackState::new();
session.in_flight_prompt = Some(InFlightPrompt {
text: "stash me".into(),
images: Vec::new(),
scrollback_entry: EntryId::new(2),
chip_elements: Vec::new(),
});
apply_retry_state(
&RetryState::Exhausted {
attempts: 3,
reason: "status 403: run out of credits".into(),
is_rate_limited: false,
},
&mut session,
&mut scrollback,
false,
);
assert!(
session.credit_limit_blocked,
"credit_limit_blocked must be set for credit-limit 403"
);
assert!(
session.in_flight_prompt.is_some(),
"in_flight_prompt must be preserved so PromptResponse handler can stash it"
);
assert_eq!(session.in_flight_prompt.unwrap().text, "stash me");
}
#[test]
fn apply_retry_state_credit_limit_failed_preserves_in_flight_prompt() {
let mut session = make_session(Some("s1"));
let mut scrollback = ScrollbackState::new();
session.in_flight_prompt = Some(InFlightPrompt {
text: "stash me too".into(),
images: Vec::new(),
scrollback_entry: EntryId::new(3),
chip_elements: Vec::new(),
});
apply_retry_state(
&RetryState::Failed {
error_type: "proxy_error".into(),
message: "status 403: run out of credits".into(),
},
&mut session,
&mut scrollback,
false,
);
assert!(
session.credit_limit_blocked,
"credit_limit_blocked must be set for credit-limit 403"
);
assert!(
session.in_flight_prompt.is_some(),
"in_flight_prompt must be preserved so PromptResponse handler can stash it"
);
assert_eq!(session.in_flight_prompt.unwrap().text, "stash me too");
}
#[test]
fn apply_retry_state_pool_402_sets_credit_limit_blocked() {
let mut session = make_session(Some("s1"));
let mut scrollback = ScrollbackState::new();
session.in_flight_prompt = Some(InFlightPrompt {
text: "pool blocked".into(),
images: Vec::new(),
scrollback_entry: EntryId::new(5),
chip_elements: Vec::new(),
});
apply_retry_state(
&RetryState::Failed {
error_type: "proxy_error".into(),
message:
"API error (status 402 Payment Required): Grok Build usage balance exhausted"
.into(),
},
&mut session,
&mut scrollback,
false,
);
assert!(
session.credit_limit_blocked,
"credit_limit_blocked must be set for pool 402 balance exhausted"
);
assert!(session.in_flight_prompt.is_some());
}
#[test]
fn apply_retry_state_non_credit_limit_failed_clears_in_flight_prompt() {
fn apply_retry_state_generic_failed_clears_in_flight_prompt() {
let mut session = make_session(Some("s1"));
let mut scrollback = ScrollbackState::new();
session.in_flight_prompt = Some(InFlightPrompt {
@@ -345,13 +213,9 @@
&mut scrollback,
false,
);
assert!(
!session.credit_limit_blocked,
"credit_limit_blocked must NOT be set for non-credit-limit errors"
);
assert!(
session.in_flight_prompt.is_none(),
"in_flight_prompt must be cleared for non-credit-limit errors"
"in_flight_prompt must be cleared for generic errors"
);
}
@@ -400,7 +264,6 @@
),
"auth 401 must surface the actionable re-auth prompt"
);
assert!(!session.credit_limit_blocked);
}
/// A recoverable auth failure preserves `in_flight_prompt` so the
crates/codegen/kigi-tui/src/app/acp_handler/tests/settings.rs
-35
View File
@@ -1,41 +1,6 @@
#![cfg_attr(rustfmt, rustfmt::skip)]
use super::*;
#[test]
fn settings_non_api_key_tier_clears_stale_api_key_flag() {
let mut app = make_app_with_agent("sess-stale-key");
assert!(handle_ext_notification(
&tier_settings_update("API Key"),
&mut app
));
assert!(app.is_api_key_auth);
assert!(!app.usage_visible);
assert!(app.tier_restricted_commands.is_empty());
// Later personal Free stamp must not keep the API-key bypass.
assert!(handle_ext_notification(
&tier_settings_update("Free"),
&mut app
));
assert!(!app.is_api_key_auth);
assert!(app.usage_visible);
// Tier gating no longer exists; nothing gets re-restricted.
assert!(app.tier_restricted_commands.is_empty());
// A paid tier after API Key clears the api-key flag and tier limits.
let mut app = make_app_with_agent("sess-paid-tier");
assert!(handle_ext_notification(
&tier_settings_update("API Key"),
&mut app
));
assert!(handle_ext_notification(
&tier_settings_update("SuperGrok"),
&mut app
));
assert!(!app.is_api_key_auth);
assert!(app.tier_restricted_commands.is_empty());
}
#[test]
fn settings_update_clearing_group_tool_verbs_reverts_to_default() {
// Expected values come from the same chain the handler resolves, so the
crates/codegen/kigi-tui/src/app/actions.rs
+7 -113
View File
@@ -56,10 +56,6 @@ pub enum Action {
ExitSession,
/// Exit session without double-press confirmation (e.g., from command palette).
ExitSessionConfirmed,
/// Open grok.com in the browser for SuperGrok subscription upsell.
OpenSupergrokUrl,
/// Re-check subscription status via the shell's `x.ai/auth/check_subscription`.
CheckSubscription,
/// Open an arbitrary URL in the system browser (with scheme validation).
OpenUrl(String),
/// Open grok.com managed connectors, appending session teamId when set.
@@ -587,8 +583,6 @@ pub enum Action {
TrustFolder,
/// A spawned task completed.
TaskComplete(TaskResult),
/// Share the current session via URL.
ShareSession,
/// Show session info (ID, cwd, model, context usage) instantly.
ShowSessionInfo,
/// Show release notes in a modal.
@@ -602,7 +596,7 @@ pub enum Action {
},
/// Show detailed context usage (progress bar, token breakdown, stats).
ShowContextInfo,
/// Show credit usage via /usage command.
/// Show Kimi usage/quota via the /usage command.
ShowUsage,
/// Commit a read-only list of the queued prompts as a system block
/// (`/queue`). The surface minimal mode uses in place of the `QueuePane`.
@@ -663,11 +657,6 @@ pub enum Action {
TriggerDeepSearch,
/// Force an immediate deep content search, skipping the debounce.
ForceDeepSearch,
/// Show privacy and data retention status.
ShowPrivacyInfo,
SetCodingDataSharing {
opted_in: bool,
},
/// `/fork` slash command: parsed args produced by
/// [`crate::slash::commands::fork::parse_fork_args`]. The dispatcher
/// resolves the worktree question (via flag or the local
@@ -1698,11 +1687,6 @@ pub enum Effect {
tool_name: String,
enabled: bool,
},
/// Share the current session via URL.
ShareSession {
agent_id: AgentId,
session_id: acp::SessionId,
},
/// Fetch and display session info via x.ai/session/info.
ShowSessionInfo {
agent_id: AgentId,
@@ -1777,19 +1761,6 @@ pub enum Effect {
},
/// Log out via `x.ai/auth/logout` (shell clears auth.json + in-memory state).
Logout,
/// Re-check subscription status via `x.ai/auth/check_subscription`.
/// `verify` scopes the result to a deferred-gate verification (see
/// [`crate::app::subscription`]); `None` for generic checks.
CheckSubscription { verify: Option<u64> },
/// One-shot subscription re-check triggered by a credit-limit 403.
/// If the tier changed, the stashed prompt is retried instead of
/// showing the upsell modal.
CreditLimitRecheck { agent_id: AgentId },
/// Schedule a 5s timer that fires `TaskResult::PaywallCheckTick`.
SchedulePaywallCheck,
/// Schedule `TaskResult::GateVerifyTimeout { generation }` after
/// [`crate::app::subscription::GATE_VERIFY_TIMEOUT`].
ScheduleGateVerifyTimeout { generation: u64 },
/// Log out then authenticate sequentially in one task.
SwitchAccount {
request_seq: u64,
@@ -1808,13 +1779,6 @@ pub enum Effect {
UnregisterActiveSession { session_id: acp::SessionId },
/// Quit the application.
Quit,
/// Toggle coding data sharing via ACP.
SetCodingDataSharing {
agent_id: AgentId,
opted_in: bool,
/// Pre-toggle value to revert to on failure.
rollback_to_opted_in: bool,
},
/// Rename the current session.
RenameSession {
agent_id: AgentId,
@@ -1871,16 +1835,9 @@ pub enum Effect {
target_prompt_index: usize,
mode: crate::views::rewind::RewindMode,
},
/// Fetch billing/credit usage from the agent's `x.ai/billing` extension.
/// When `silent` is true the result updates `credit_balance` without
/// pushing a system message into scrollback (used for automatic refreshes
/// on session init and after each turn).
FetchBilling { agent_id: AgentId, silent: bool },
/// Fetch billing data at the app level (no agent required).
/// Used on startup to populate the welcome-screen credit warning.
FetchAppBilling,
/// Re-fetch remote settings to check subscription gate.
RefreshGate,
/// Fetch Kimi usage/quota rows from the agent's `x.ai/billing`
/// extension (`GET {base}/usages` shell-side) for the `/usage` view.
FetchUsage { agent_id: AgentId },
/// Spawn a debounce sleep task for shell suggestions. `agent_id` rides
/// to the expiry so the fetch is built from the arming agent, not
/// whatever view is active when the timer fires.
@@ -2019,9 +1976,6 @@ pub enum TaskResult {
/// Session list fetched for the welcome screen picker.
SessionListLoaded {
sessions: Vec<crate::app::app_view::SessionPickerEntry>,
/// Degraded conversations lane (`_meta["x.ai/partial"]`), surfaced
/// as an actionable picker notice instead of a silent empty list.
partial: Option<crate::app::effects::ConversationsPartial>,
/// Echo of [`Effect::FetchSessionList::seq`]; stale results are dropped.
seq: u64,
/// Echo of [`Effect::FetchSessionList::query`]. `Some` marks the
@@ -2256,16 +2210,6 @@ pub enum TaskResult {
agent_id: AgentId,
result: Result<(), String>,
},
/// Share session completed successfully.
ShareSessionComplete {
agent_id: AgentId,
share_url: String,
},
/// Share session failed.
ShareSessionFailed {
agent_id: AgentId,
error: String,
},
/// Session info fetched successfully.
SessionInfoComplete {
agent_id: AgentId,
@@ -2277,17 +2221,6 @@ pub enum TaskResult {
agent_id: AgentId,
error: String,
},
/// Coding data sharing preference updated.
CodingDataSharingUpdated {
agent_id: AgentId,
opted_in: bool,
},
/// Coding data sharing update failed.
CodingDataSharingFailed {
agent_id: AgentId,
error: String,
rollback_to_opted_in: bool,
},
/// Session rename completed successfully.
RenameSessionComplete {
agent_id: AgentId,
@@ -2405,25 +2338,6 @@ pub enum TaskResult {
},
/// Shell acknowledged logout (auth cleared).
LogoutComplete,
/// Shell responded to `x.ai/auth/check_subscription`. `verify` echoes
/// the generation from `Effect::CheckSubscription` for deferred-gate
/// verifications.
CheckSubscriptionComplete {
verify: Option<u64>,
meta: Option<serde_json::Value>,
},
/// Result of the credit-limit subscription re-check. If the tier
/// changed the stashed prompt is retried; otherwise the upsell is shown.
CreditLimitRecheckComplete {
agent_id: AgentId,
meta: Option<serde_json::Value>,
},
/// 5s paywall check timer fired -- time to send another check.
PaywallCheckTick,
/// The deferred-gate verification window expired.
GateVerifyTimeout {
generation: u64,
},
/// The 2-second "copied!" display timer expired.
AuthCopiedTimeout,
DeepSearchResults {
@@ -2470,30 +2384,10 @@ pub enum TaskResult {
agent_id: AgentId,
error: String,
},
/// Billing data fetched from the agent.
BillingFetched {
/// Kimi usage/quota rows fetched for the `/usage` view.
UsageFetched {
agent_id: AgentId,
balance: Option<crate::views::credit_bar::CreditBalance>,
/// When true, update `credit_balance` silently (no scrollback message).
silent: bool,
/// Subscription tier piggybacked from remote settings.
subscription_tier: Option<String>,
/// Auto top-up rule fetch result; `Unchanged` keeps any cached rule.
autotopup: crate::views::credit_bar::AutoTopupFetch,
},
/// App-level billing data (welcome screen).
AppBillingFetched {
balance: Option<crate::views::credit_bar::CreditBalance>,
autotopup: crate::views::credit_bar::AutoTopupFetch,
},
GateRefreshed {
settings: Option<kigi_shell::util::config::RemoteSettings>,
},
BillingError {
agent_id: AgentId,
error: String,
/// When true, swallow the error silently (background refresh).
silent: bool,
result: Result<Vec<kigi_shell::extensions::billing::UsageRow>, String>,
},
/// Debounce timer for shell suggestions expired. Routed by the arming
/// `agent_id`.
crates/codegen/kigi-tui/src/app/agent.rs
-14
View File
@@ -653,16 +653,6 @@ pub struct AgentSession {
/// fires, so the subsequent `TurnFailed` can be suppressed (the retry handler
/// already displayed a user-friendly message). Cleared on `finish_turn`.
pub model_incompatible: bool,
/// Set when a `RetryState::Failed` carries a 403 credit-limit error, so
/// the error message is suppressed in favour of the upsell modal.
/// Cleared on `finish_turn`.
pub credit_limit_blocked: bool,
/// Set when a rate-limit `RetryState::Exhausted` carries the
/// `subscription:free-usage-exhausted` code, so the PromptResponse
/// handler shows the free-usage paywall instead of the generic
/// rate-limit message. Always set together with [`Self::rate_limited`].
/// Cleared on `finish_turn`.
pub free_usage_blocked: bool,
pub(crate) tracker: AcpUpdateTracker,
/// ACP-advertised slash commands. Seeded from `InitializeResponse.meta`,
/// updated by `AvailableCommandsUpdate`. The prompt-side registry syncs
@@ -796,8 +786,6 @@ impl AgentSession {
self.state = AgentState::Idle;
self.rate_limited = false;
self.model_incompatible = false;
self.credit_limit_blocked = false;
self.free_usage_blocked = false;
self.in_flight_prompt = None;
self.current_prompt_id = None;
}
@@ -999,8 +987,6 @@ mod tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/agent_view/input.rs
+3 -4
View File
@@ -678,7 +678,6 @@ impl AgentView {
.hit_plan_approval_status
.update_hover(mouse.column, mouse.row);
changed |= self.hit_context.update_hover(mouse.column, mouse.row);
changed |= self.hit_credits.update_hover(mouse.column, mouse.row);
}
MouseEventKind::Down(MouseButton::Left) => {
if self.hit_plan_button.contains(mouse.column, mouse.row) {
@@ -943,7 +942,7 @@ impl AgentView {
|| (key.code == KeyCode::Char('/') && key.modifiers.contains(KeyModifiers::SHIFT)))
{
self.active_modal = Some(crate::views::modal::ActiveModal::CommandPalette {
entries: crate::views::modal::default_palette_entries(self.sharing_enabled),
entries: crate::views::modal::default_palette_entries(),
state: crate::views::picker::PickerState::input_active(),
window: crate::views::modal_window::ModalWindowState::new(),
});
@@ -1016,7 +1015,7 @@ impl AgentView {
}
ActionId::CommandPalette => {
self.active_modal = Some(crate::views::modal::ActiveModal::CommandPalette {
entries: crate::views::modal::default_palette_entries(self.sharing_enabled),
entries: crate::views::modal::default_palette_entries(),
state: crate::views::picker::PickerState::input_active(),
window: crate::views::modal_window::ModalWindowState::new(),
});
@@ -1462,7 +1461,7 @@ mod focus_gained_restore_tests {
agent.session.state = AgentState::TurnRunning;
with_permission(&mut agent);
agent.active_modal = Some(ActiveModal::CommandPalette {
entries: crate::views::modal::default_palette_entries(false),
entries: crate::views::modal::default_palette_entries(),
state: crate::views::picker::PickerState::input_active(),
window: crate::views::modal_window::ModalWindowState::new(),
});
crates/codegen/kigi-tui/src/app/agent_view/interactions.rs
-2
View File
@@ -1261,8 +1261,6 @@ mod cancel_turn_mouse_tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/agent_view/mod.rs
-34
View File
@@ -727,10 +727,6 @@ pub struct AgentView {
/// Stashed normal prompt state while editing a queued prompt.
/// Restored when editing ends.
pub stashed_prompt: Option<StashedPrompt>,
/// Complete prompt stashed from a credit-limit-blocked turn. Used by
/// `CreditLimitRecheckComplete` to retry the prompt after a tier
/// upgrade instead of showing a stale upsell.
pub credit_limit_stashed_prompt: Option<crate::app::agent::InFlightPrompt>,
/// Complete prompt stashed from a turn that failed because the login
/// expired (401 / re-auth). Used by the `AuthComplete` handler to
/// auto-resubmit the prompt after a successful mid-session re-auth so
@@ -754,10 +750,6 @@ pub struct AgentView {
/// Unlike `chat_kind`, stays `false` for a `/chat` one-shot session in
/// a Build process, whose picker still lists local sessions.
pub app_chat_mode: bool,
/// Mocked credit balance for the status bar indicator.
pub credit_balance: Option<crate::views::credit_bar::CreditBalance>,
/// Auto top-up rule paired with `credit_balance` for the prompt warning.
pub auto_topup: Option<crate::views::credit_bar::AutoTopupInfo>,
/// Current goal orchestration state. Set by `GoalUpdated` session
/// notifications, cleared when a new session starts.
pub goal_state: Option<super::agent::GoalDisplayState>,
@@ -947,7 +939,6 @@ pub struct AgentView {
pub hovered_prompt: bool,
pub hit_badge: HitArea,
pub hit_context: HitArea,
pub hit_credits: HitArea,
pub hit_todo_close: HitArea,
pub hit_bg_close: HitArea,
pub hit_subagent_close: HitArea,
@@ -1235,8 +1226,6 @@ pub struct AgentView {
/// Hit area for the [✗] close button in the subagent frame title bar.
pub hit_subagent_frame_close: HitArea,
/// Whether the `/share` slash command is available (mirrors
/// `AppView::sharing_enabled`). Used to gate palette entries.
pub sharing_enabled: bool,
/// Input flight recorder — rolling buffer of recent key events.
/// Dumped to file via Esc→d combo for debugging.
pub(crate) input_log: crate::input_log::InputRingBuffer,
@@ -1512,23 +1501,6 @@ fn translate_local_submit(
persist_mode,
})
}
LocalQuestionKind::CreditLimitUpsell => {
let q = qv.questions.first();
let url = q
.and_then(|q| q.options.get(*idx))
.and_then(|o| o.id.as_deref())
.unwrap_or(super::dispatch::UPSELL_URL_PAYG);
InputOutcome::Action(Action::OpenUrl(url.to_string()))
}
LocalQuestionKind::FreeUsageUpsell => {
let url = qv
.questions
.first()
.and_then(|q| q.options.get(*idx))
.and_then(|o| o.id.as_deref())
.unwrap_or(super::dispatch::UPSELL_URL_UPGRADE);
InputOutcome::Action(Action::OpenUrl(url.to_string()))
}
LocalQuestionKind::AgentTypeMismatch { model_id, effort } => {
let start_new = *idx == 0;
InputOutcome::Action(Action::AgentTypeMismatchAnswered {
@@ -2217,8 +2189,6 @@ pub(super) mod test_fixtures {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -2278,8 +2248,6 @@ pub(super) mod test_fixtures {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -3010,8 +2978,6 @@ pub(crate) fn test_agent_view(session_id: Option<&str>, cwd: std::path::PathBuf)
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/agent_view/paste.rs
-2
View File
@@ -454,8 +454,6 @@ pub(super) mod paste_key_tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/agent_view/plan.rs
-2
View File
@@ -703,8 +703,6 @@ mod plan_chip_tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/agent_view/render.rs
-26
View File
@@ -329,7 +329,6 @@ impl AgentView {
let thinking_label = self.scrollback.thinking_fold_label();
let selected_is_user_prompt = selected_entry.is_some_and(|e| e.block.is_user_prompt());
let selected_is_agent_message = selected_entry.is_some_and(|e| e.block.is_agent_message());
let selected_is_credit_limit = selected_entry.is_some_and(|e| e.block.is_credit_limit());
let mut hints = agent::build_hints(
self.active_pane,
&self.prompt,
@@ -355,7 +354,6 @@ impl AgentView {
!self.visible_queue_is_empty(),
selected_is_user_prompt,
selected_is_agent_message,
selected_is_credit_limit,
crate::terminal::terminal_context().shift_enter_unavailable(),
self.scrollback_search.as_ref(),
);
@@ -1300,7 +1298,6 @@ impl AgentView {
self.hit_bg_status.rect = areas.get("bg_tasks").copied();
self.hit_goal_status.rect = areas.get("goal").copied();
self.hit_context.rect = areas.get("context").copied();
self.hit_credits.rect = areas.get("credits").copied();
self.hit_plan_button.rect = areas.get("plan").copied();
self.hit_queue_badge.rect = areas.get("queue").copied();
self.hit_badge.rect = areas.get("badge").copied();
@@ -2041,23 +2038,6 @@ impl AgentView {
}
let mode_flags: &[PromptFlag] = &mode_flags_vec;
let multiline = self.multiline_mode;
let usage_visible = self
.prompt
.slash_controller
.registry()
.get("usage")
.is_some();
let warning = self.credit_balance.as_ref().and_then(|bal| {
crate::views::credit_bar::usage_warning_for_session(
bal,
self.auto_topup.as_ref(),
usage_visible,
self.chat_kind,
)
});
let usage_warning_text: Option<String> = warning.as_ref().map(|(t, _)| t.clone());
let usage_warning = usage_warning_text.as_deref();
let usage_warning_critical = warning.is_some_and(|(_, critical)| critical);
let model_label = match self.session.models.reasoning_effort {
Some(eff) => format!("{model_id} ({eff})"),
None => model_id,
@@ -2067,8 +2047,6 @@ impl AgentView {
model_name: &model_label,
flags: mode_flags,
multiline,
usage_warning,
usage_warning_critical,
},
PromptMode::EditingQueued { id, .. } => {
let pos = self.session.queue_position(*id).map(|i| i + 1).unwrap_or(1);
@@ -2077,8 +2055,6 @@ impl AgentView {
model_name: &editing_label,
flags: mode_flags,
multiline,
usage_warning,
usage_warning_critical,
}
}
};
@@ -2087,8 +2063,6 @@ impl AgentView {
model_name: label,
flags: &[],
multiline: false,
usage_warning,
usage_warning_critical,
}
} else {
info
crates/codegen/kigi-tui/src/app/agent_view/rewind.rs
-2
View File
@@ -206,8 +206,6 @@ mod sync_rewind_anchor_to_picker_tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/agent_view/session.rs
+1 -35
View File
@@ -1,5 +1,5 @@
//! Session lifecycle: bind/reload/replay bookkeeping, turn activity
//! resolution, context/credit updates, and app-scoped gates.
//! resolution, context updates, and app-scoped gates.
#[cfg(test)]
use super::test_agent_view;
use super::{
@@ -85,7 +85,6 @@ impl AgentView {
bash_turn: false,
cron_task_id: None,
stashed_prompt: None,
credit_limit_stashed_prompt: None,
reauth_stashed_prompt: None,
active_modal: None,
modal_buttons: Vec::new(),
@@ -93,8 +92,6 @@ impl AgentView {
context_state: None,
chat_kind: false,
app_chat_mode: false,
credit_balance: None,
auto_topup: None,
goal_state: None,
parked_wait_marker_for: None,
end_work_announced: false,
@@ -152,7 +149,6 @@ impl AgentView {
hovered_prompt: false,
hit_badge: Default::default(),
hit_context: Default::default(),
hit_credits: Default::default(),
hit_todo_close: Default::default(),
hit_bg_close: Default::default(),
hit_subagent_close: Default::default(),
@@ -257,7 +253,6 @@ impl AgentView {
active_subagent: None,
is_subagent_view: false,
hit_subagent_frame_close: Default::default(),
sharing_enabled: false,
input_log: crate::input_log::InputRingBuffer::new(),
esc_pressed_at: None,
pending_first_prompt: None,
@@ -740,21 +735,6 @@ impl AgentView {
}
}
}
/// Apply Build coding-credit balance only for non-chat agents.
/// Gateway/chat-kind sessions keep credits unset so bars/warnings stay off.
pub fn apply_credit_balance(
&mut self,
balance: Option<crate::views::credit_bar::CreditBalance>,
auto_topup: Option<crate::views::credit_bar::AutoTopupInfo>,
) {
if self.chat_kind {
self.credit_balance = None;
self.auto_topup = None;
return;
}
self.credit_balance = balance;
self.auto_topup = auto_topup;
}
/// Record a key event to the input flight recorder.
///
/// Zero heap allocations — stores raw `Copy` types in the ring buffer.
@@ -801,18 +781,6 @@ impl AgentView {
textarea_changed: delta.textarea_changed,
});
}
/// Set the sharing-enabled flag on this view and propagate it to the
/// slash-command registry so the `/share` entry stays hidden/visible in
/// lockstep with `AgentView::sharing_enabled`. Use this instead of
/// mutating `sharing_enabled` directly when a new agent is created or a
/// session is loaded, so the field and registry can't drift.
pub fn set_sharing_enabled(&mut self, enabled: bool) {
self.sharing_enabled = enabled;
self.prompt
.slash_controller
.registry_mut()
.set_share_visible(enabled);
}
/// Show or hide the `/usage` slash command in this agent's registry.
pub fn set_usage_visible(&mut self, visible: bool) {
self.prompt
@@ -839,13 +807,11 @@ impl AgentView {
/// One place for the app-scoped gates a new/adopted session inherits so the session-creation sites cannot drift.
pub(crate) fn apply_app_scoped_gates(
&mut self,
sharing_enabled: bool,
usage_visible: bool,
chat_mode: bool,
screen_mode: crate::app::ScreenMode,
restricted_commands: &[String],
) {
self.set_sharing_enabled(sharing_enabled);
self.set_usage_visible(usage_visible);
self.app_chat_mode = chat_mode;
self.prompt.set_screen_mode(screen_mode);
crates/codegen/kigi-tui/src/app/app_view.rs
+10 -357
View File
@@ -386,28 +386,6 @@ fn parse_esc_ttl(raw: Option<String>) -> Duration {
.map(|ms| Duration::from_millis(ms.min(ESC_DOUBLE_PRESS_TEST_MS)))
.unwrap_or(PendingAction::ESC_DOUBLE_PRESS_TTL)
}
/// Slash commands unavailable on the free and X Basic subscription tiers.
///
/// To restrict another command for these tiers, add its canonical name
/// (no leading `/`) here — matching covers aliases automatically via
/// [`crate::slash::registry::CommandRegistry::set_restricted_commands`].
///
/// Current set:
/// - `usage` — coding credit / billing UI (alias: `/cost`)
/// - `imagine` — image generation entry point
/// - `imagine-video` — video generation entry point
pub(crate) const TIER_RESTRICTED_COMMANDS: &[&str] = &["usage", "imagine", "imagine-video"];
/// Whether a subscription-tier display name is a tier with restricted
/// commands: the free tier (no subscription ⇒ `None`, or an explicit
/// "Free") and X Basic (CCP display name "X Basic"; JWT claim fallback
/// "x_basic"). Everything else — paid tiers and unknown future names —
/// is unrestricted (fail-open).
///
/// Tier gating was an xAI concept; the Kimi Code subscription has no
/// client-visible tier, so nothing is ever restricted.
fn is_restricted_tier(_tier: Option<&str>) -> bool {
false
}
/// True for API-key labels from shell/CCP: `"ApiKey"`, `"API Key"`, `"api_key"`.
pub(crate) fn is_api_key_label(s: &str) -> bool {
s.trim().to_ascii_lowercase().replace([' ', '_', '-'], "") == "apikey"
@@ -519,19 +497,9 @@ pub struct AppView {
pub tip: Option<String>,
/// Whether to show the resolved model ID in /session-info output.
pub show_resolved_model: bool,
/// Whether the `/share` slash command is available. Gated by
/// `RemoteSettings.sharing_enabled`; defaults to `false` when remote
/// settings are unavailable or the field is absent.
pub sharing_enabled: bool,
/// Whether the `/usage` slash command is available. Hidden for team
/// (`team_name.is_some()`) and API-key auth.
pub usage_visible: bool,
/// Slash commands denied for the current subscription tier
/// ([`TIER_RESTRICTED_COMMANDS`] when the user is on the free / X Basic
/// tier, empty otherwise). Recomputed by [`Self::apply_tier_restrictions`]
/// and fanned out to every slash registry (welcome prompt, agents,
/// dashboard); deny wins over all other visibility gates.
pub tier_restricted_commands: Vec<String>,
/// Whether the pager is connected via a leader (leader mode). The Agent
/// Dashboard entry points (`/dashboard`, `Ctrl+\`, `grok dashboard`, the
/// startup hook) are only meaningful when a leader is coordinating a
@@ -539,13 +507,6 @@ pub struct AppView {
/// `event_loop::run` from `connection.leader_status_rx.is_some()`;
/// defaults to `false` (non-leader, dashboard hidden).
pub leader_mode: bool,
/// App-level credit balance used to show the usage warning on the
/// welcome screen before any agent session exists.
pub credit_balance: Option<crate::views::credit_bar::CreditBalance>,
/// App-level auto top-up rule paired with `credit_balance` for the warning.
pub auto_topup: Option<crate::views::credit_bar::AutoTopupInfo>,
/// Periodic billing poll requested (credits >= 99%).
pub billing_poll_wanted: bool,
/// Leader-mode session roster (FleetView dashboard). Populated from
/// `x.ai/sessions/list` polls and `x.ai/sessions/changed` broadcasts.
/// Empty in non-leader mode, which naturally gates roster rendering.
@@ -667,9 +628,7 @@ pub struct AppView {
/// Hit-test rect for the "show full URL" fallback link.
pub welcome_auth_fallback_rect: Option<ratatui::layout::Rect>,
/// Hit-test rect for the "[Refresh]" button on the paywall tier line.
pub welcome_refresh_rect: Option<ratatui::layout::Rect>,
/// Hit-test rect for the gate URL link on the paywall CTA.
pub welcome_gate_url_rect: Option<ratatui::layout::Rect>,
/// Hit-test rect for the clickable changelog info block (opens release notes).
pub welcome_changelog_cta_rect: Option<ratatui::layout::Rect>,
/// Show the raw auth URL with mouse capture disabled for manual copy.
@@ -833,16 +792,6 @@ pub struct AppView {
pub auth_use_oauth: bool,
/// Whether the last clipboard copy during auth succeeded.
pub auth_clipboard_copied: bool,
/// Team principal UUID from auth (`None` for personal sessions).
pub team_id: Option<String>,
/// Team name from auth (displayed in the shortcuts bar).
pub team_name: Option<String>,
/// Whether the user's team has enterprise Zero Data Retention enabled.
pub is_zdr: bool,
/// Team role (e.g. "Admin", "Member", "Read Only") for access-control checks.
pub team_role: Option<String>,
/// Whether the user has opted out of coding data retention.
pub coding_data_retention_opt_out: bool,
/// Persisted `[cli].show_tips` mirror. `None` = no override (default `true`).
pub show_tips: Option<bool>,
/// Persisted `[cli].auto_update` mirror. `None` = no override (default `true`).
@@ -851,31 +800,6 @@ pub struct AppView {
/// from the effective TOML merge like `show_tips`. `None` = unset in TOML
/// (default `true`); toggles write the user layer.
pub ask_user_question_timeout_enabled: Option<bool>,
/// Whether ZDR users are allowed to use the product.
/// Server-controlled via RemoteSettings (remote settings). Default `false` (blocked) during beta.
pub zdr_access_enabled: bool,
/// When set, `/usage` shows a link to this URL instead of fetching billing
/// data from the backend. Server-controlled via RemoteSettings (remote settings
/// `grok_build_usage_redirect_url`, targeted at personal-team users).
/// `None` (default) fetches usage from the backend.
pub usage_billing_redirect_url: Option<String>,
pub access_gate_shown_logged: bool,
/// Access gate from `grok_build_access_gate`. `Some` = blocked.
pub gate: Option<kigi_shell::auth::GateInfo>,
/// User-friendly subscription tier name (e.g. "SuperGrok", "Free").
pub subscription_tier: Option<String>,
/// When the pager started auto-checking subscriptions (for 10-min timeout).
pub paywall_check_started: Option<std::time::Instant>,
/// Debounce stamp for watch/focus subscription checks (see
/// [`super::subscription`]).
pub last_subscription_check_at: Option<std::time::Instant>,
/// Server override (seconds) for the subscription-watch cadence.
pub subscription_watch_interval_secs: Option<u64>,
/// A stale-source gate held out of `gate` while a live check verifies
/// it (see [`super::subscription`]).
pub pending_gate_verification: Option<kigi_shell::auth::GateInfo>,
/// Generation stamp of the current gate verification.
pub gate_verify_gen: u64,
/// Whether a leader reconnect is in progress (blocks prompt submission).
pub reconnect_pending: bool,
/// Structured startup warnings collected from the terminal diagnostics
@@ -923,17 +847,6 @@ pub struct AppView {
pub(crate) keyboard_normalizer: KeyboardNormalizer,
}
impl AppView {
pub fn is_zdr_blocked(&self) -> bool {
self.is_zdr && !self.zdr_access_enabled
}
/// User is not gated (no gate from remote settings or subscription fallback).
pub fn has_access(&self) -> bool {
self.gate.is_none()
}
/// True when the user should not see the prompt (gate, subscription, or ZDR).
pub fn is_access_blocked(&self) -> bool {
!self.has_access() || self.is_zdr_blocked()
}
/// Whether deferred session-startup actions may run: both auth AND folder
/// trust must be resolved. Mirrors the auth gate at the session-creating
/// startup sites; trust is gated AFTER auth so a pending trust question
@@ -941,33 +854,12 @@ impl AppView {
pub fn session_startup_allowed(&self) -> bool {
matches!(self.auth_state, AuthState::Done) && matches!(self.trust_state, TrustState::Done)
}
/// Extract `GateInfo` from `RemoteSettings`.
pub fn gate_from_settings(
rs: &kigi_shell::util::config::RemoteSettings,
) -> Option<kigi_shell::auth::GateInfo> {
let msg = rs.gate_message.as_ref()?;
if msg.is_empty() {
return None;
}
Some(kigi_shell::auth::GateInfo {
message: msg.clone(),
url: rs.gate_url.clone(),
label: rs.gate_label.clone(),
})
}
/// Apply typed auth metadata from the shell. The Kimi auth model carries
/// no team/tier/gate info; those fields only ever come from remote
/// settings now.
/// Apply typed auth metadata from the shell: auth mode (drives the
/// API-key badge and `/usage` visibility) and the resolved-model display
/// preference. The Kimi auth model carries no team/tier/gate info.
pub fn apply_auth_meta(&mut self, meta: &kigi_shell::auth::AuthMeta) {
self.pending_gate_verification = None;
let was_gated = self.gate.is_some();
self.gate = None;
if was_gated {
self.paywall_check_started = None;
}
self.is_api_key_auth = meta.auth_mode.as_deref().is_some_and(is_api_key_label);
self.usage_visible = !self.is_api_key_auth;
self.apply_tier_restrictions();
if let Some(show) = meta.show_resolved_model {
self.show_resolved_model = show;
}
@@ -1038,8 +930,6 @@ impl AppView {
welcome_on_auth_url: false,
welcome_on_changelog_cta: false,
welcome_auth_fallback_rect: None,
welcome_refresh_rect: None,
welcome_gate_url_rect: None,
welcome_changelog_cta_rect: None,
auth_show_raw_url: false,
auth_mouse_disabled: false,
@@ -1098,24 +988,9 @@ impl AppView {
deferred_startup: Default::default(),
auth_use_oauth: false,
auth_clipboard_copied: false,
team_id: None,
team_name: None,
is_zdr: false,
team_role: None,
coding_data_retention_opt_out: false,
show_tips: None,
auto_update: None,
ask_user_question_timeout_enabled: None,
zdr_access_enabled: false,
usage_billing_redirect_url: None,
access_gate_shown_logged: false,
gate: None,
subscription_tier: None,
paywall_check_started: None,
last_subscription_check_at: None,
subscription_watch_interval_secs: None,
pending_gate_verification: None,
gate_verify_gen: 0,
reconnect_pending: false,
startup_warnings: Vec::new(),
is_api_key_auth: false,
@@ -1129,13 +1004,8 @@ impl AppView {
welcome_doc_viewer: None,
screen_mode: ScreenMode::Inline,
show_resolved_model: true,
sharing_enabled: false,
usage_visible: true,
tier_restricted_commands: Vec::new(),
leader_mode: false,
credit_balance: None,
auto_topup: None,
billing_poll_wanted: false,
leader_roster: Vec::new(),
dashboard_local_sessions: Vec::new(),
dashboard_sessions_loading: false,
@@ -1178,35 +1048,6 @@ impl AppView {
dashboard.set_auto_mode_available(available);
}
}
/// Recompute the tier-restricted slash commands from the current auth
/// state and sync the deny list into every slash surface (welcome
/// prompt, all agents, dashboard) so restricted commands hide/show in
/// lockstep.
///
/// Called from [`Self::apply_auth_meta`] (startup / login) and from the
/// `x.ai/settings/update` handler when the subscription tier changes, so
/// a mid-session upgrade lifts the restrictions without a restart.
pub fn apply_tier_restrictions(&mut self) {
let restricted = self.team_name.is_none()
&& !self.is_api_key_auth
&& is_restricted_tier(self.subscription_tier.as_deref());
let names: Vec<String> = if restricted {
TIER_RESTRICTED_COMMANDS
.iter()
.map(|n| (*n).to_string())
.collect()
} else {
Vec::new()
};
for agent in self.agents.values_mut() {
agent.set_restricted_commands(&names);
}
self.welcome_prompt.set_restricted_commands(&names);
if let Some(dashboard) = self.dashboard.as_mut() {
dashboard.set_restricted_commands(&names);
}
self.tier_restricted_commands = names;
}
/// Session ID of the active agent, if one exists and has an established session.
pub fn active_session_id(&self) -> Option<&str> {
match self.active_view {
@@ -1667,8 +1508,6 @@ impl AppView {
);
if is_mouse_action {}
}
let zdr_blocked = self.is_zdr_blocked();
let has_access = self.has_access();
let has_foreign_resume = self.foreign_resume_hint().is_some();
let outcome = match self.active_view {
ActiveView::Welcome => handle_welcome_input(
@@ -1684,27 +1523,20 @@ impl AppView {
new_worktree_dialog: &mut self.new_worktree_dialog,
menu_index: &mut self.welcome_menu_index,
menu_rects: &self.welcome_menu_rects,
menu_count: if zdr_blocked {
2
} else {
3 + if self.has_claude_import { 1 } else { 0 }
+ if self.welcome_show_changelog_action {
1
} else {
0
}
},
menu_count: 3
+ if self.has_claude_import { 1 } else { 0 }
+ if self.welcome_show_changelog_action {
1
} else {
0
},
prompt_rect: self.welcome_prompt_rect.as_ref(),
import_banner_rect: self.welcome_import_banner_rect.as_ref(),
auth_url_rect: self.welcome_auth_url_rect.as_ref(),
auth_fallback_rect: self.welcome_auth_fallback_rect.as_ref(),
refresh_rect: self.welcome_refresh_rect.as_ref(),
gate_url_rect: self.welcome_gate_url_rect.as_ref(),
changelog_cta_rect: self.welcome_changelog_cta_rect.as_ref(),
on_changelog_cta: &mut self.welcome_on_changelog_cta,
show_raw_url: &mut self.auth_show_raw_url,
has_access,
is_zdr_blocked: zdr_blocked,
sp_entries: &mut self.session_picker_entries,
sp_state: &mut self.session_picker_state,
sp_content_results: &self.session_picker_content_results,
@@ -2228,15 +2060,11 @@ struct WelcomeInputCtx<'a> {
import_banner_rect: Option<&'a ratatui::layout::Rect>,
auth_url_rect: Option<&'a ratatui::layout::Rect>,
auth_fallback_rect: Option<&'a ratatui::layout::Rect>,
refresh_rect: Option<&'a ratatui::layout::Rect>,
gate_url_rect: Option<&'a ratatui::layout::Rect>,
/// Hit-test rect for the clickable changelog info block (opens release notes).
changelog_cta_rect: Option<&'a ratatui::layout::Rect>,
/// Sticky hover flag for the changelog block (redraw on enter/leave).
on_changelog_cta: &'a mut bool,
show_raw_url: &'a mut bool,
has_access: bool,
is_zdr_blocked: bool,
sp_entries: &'a mut Option<Vec<SessionPickerEntry>>,
sp_state: &'a mut crate::views::picker::PickerState,
sp_content_results: &'a Option<Vec<kigi_shell::extensions::session_search::SearchSessionHit>>,
@@ -2360,8 +2188,6 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
return InputOutcome::Unchanged;
}
if matches!(ctx.auth_state, AuthState::Done)
&& ctx.has_access
&& !ctx.is_zdr_blocked
&& matches!(ctx.trust_state, TrustState::Pending { .. })
{
if let Event::Key(key) = ev {
@@ -2603,22 +2429,6 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
if key.kind == KeyEventKind::Release {
return InputOutcome::Unchanged;
}
if ctx.is_zdr_blocked && matches!(ctx.auth_state, AuthState::Done) {
return handle_menu_shortcuts(
key,
ctx.menu_index,
&['l', 'q'],
dispatch_zdr_menu_action,
);
}
if !ctx.has_access && matches!(ctx.auth_state, AuthState::Done) {
return handle_menu_shortcuts(
key,
ctx.menu_index,
&['g', 'l', 'q'],
dispatch_access_gate_menu_action,
);
}
if matches!(ctx.auth_state, AuthState::Done)
&& key!(Enter).matches(key)
&& key.modifiers.is_empty()
@@ -2760,9 +2570,6 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
if let Event::Paste(text) = ev {
match ctx.auth_state {
AuthState::Done => {
if !ctx.has_access || ctx.is_zdr_blocked {
return InputOutcome::Unchanged;
}
return InputOutcome::ActionThenForward(Action::NewSession);
}
AuthState::Authenticating {
@@ -2792,12 +2599,6 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
if matches!(ctx.auth_state, AuthState::Pending { .. }) {
return dispatch_pending_menu_action(i);
}
if ctx.is_zdr_blocked {
return dispatch_zdr_menu_action(i);
}
if !ctx.has_access {
return dispatch_access_gate_menu_action(i);
}
if ctx.has_claude_import
&& i == 0
&& mouse.column >= rect.x + rect.width.saturating_sub(4)
@@ -2813,16 +2614,6 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
);
}
}
if let Some(rect) = ctx.refresh_rect
&& rect.contains(ratatui::layout::Position::new(mouse.column, mouse.row))
{
return InputOutcome::Action(Action::CheckSubscription);
}
if let Some(rect) = ctx.gate_url_rect
&& rect.contains(ratatui::layout::Position::new(mouse.column, mouse.row))
{
return InputOutcome::Action(Action::OpenSupergrokUrl);
}
if let Some(rect) = ctx.changelog_cta_rect
&& rect.contains(ratatui::layout::Position::new(mouse.column, mouse.row))
&& let Some(md) = ctx.changelog_markdown.as_deref()
@@ -2901,32 +2692,6 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
InputOutcome::Unchanged
}
/// Handle Up/Down arrow key cycling through a menu of `count` items.
fn is_quit_signal(key: &crossterm::event::KeyEvent) -> bool {
key!('c', CONTROL).matches(key) || key!('d', CONTROL).matches(key)
}
/// `shortcuts[i]` triggers `menu_dispatch(i)`.
fn handle_menu_shortcuts(
key: &crossterm::event::KeyEvent,
menu_index: &mut Option<usize>,
shortcuts: &[char],
menu_dispatch: fn(usize) -> InputOutcome,
) -> InputOutcome {
if is_quit_signal(key) {
return InputOutcome::Action(Action::Quit);
}
for (i, &ch) in shortcuts.iter().enumerate() {
if key.code == KeyCode::Char(ch) {
return menu_dispatch(i);
}
}
if key!(Enter).matches(key) {
return menu_dispatch(menu_index.unwrap_or(0));
}
if let Some(outcome) = handle_menu_nav(key, menu_index, shortcuts.len()) {
return outcome;
}
InputOutcome::Unchanged
}
fn handle_menu_nav(
key: &crossterm::event::KeyEvent,
index: &mut Option<usize>,
@@ -2959,25 +2724,6 @@ fn dispatch_pending_menu_action(index: usize) -> InputOutcome {
_ => InputOutcome::Unchanged,
}
}
/// Dispatch an action for a welcome menu item when ZDR-blocked.
/// Menu layout: 0 = Switch account, 1 = Quit.
fn dispatch_zdr_menu_action(index: usize) -> InputOutcome {
match index {
0 => InputOutcome::Action(Action::SwitchAccount),
1 => InputOutcome::Action(Action::Quit),
_ => InputOutcome::Unchanged,
}
}
/// Menu actions when user is access-gated: 0 = Subscribe CTA, 1 = Logout, 2 = Quit.
/// "Refresh" (ctrl-r) is handled as a direct key shortcut, not a menu item.
fn dispatch_access_gate_menu_action(index: usize) -> InputOutcome {
match index {
0 => InputOutcome::Action(Action::OpenSupergrokUrl),
1 => InputOutcome::Action(Action::Logout),
2 => InputOutcome::Action(Action::Quit),
_ => InputOutcome::Unchanged,
}
}
/// Dispatch an action for a welcome menu item by index.
///
/// Menu order: `[Import]`, New worktree, Resume session, `[Changelog]`, Quit.
@@ -3242,8 +2988,6 @@ impl AppView {
layout_cfg.eff_outer_vpad(compact),
)
};
let zdr_blocked_for_draw = self.is_zdr_blocked();
let has_access = self.has_access();
let scroll_debug_panel = self.scroll_debug_panel();
let dev_fps_rows = self.dev_fps_rows();
let fps_overlay = self.fps_hud.overlay(dev_fps_rows);
@@ -3337,11 +3081,8 @@ impl AppView {
model_name: &model_name,
flags: &flags_vec,
selected: self.welcome_menu_index,
team_name: self.team_name.as_deref(),
has_access,
has_claude_import: self.has_claude_import,
mouse_pos: self.last_mouse_pos,
is_zdr_blocked: zdr_blocked_for_draw,
session_picker: self.session_picker_entries.as_deref(),
session_picker_loading: self.session_picker_entries.is_none()
&& (self.session_picker_loading
@@ -3359,14 +3100,9 @@ impl AppView {
.session_picker_entries_query
.as_deref(),
welcome_tick: self.welcome_tick,
gate: self.gate.as_ref(),
subscription_tier: self.subscription_tier.as_deref(),
session_picker_grouped: self.session_picker_grouped,
session_picker_source_filter: self.session_picker_source_filter,
chat_mode: self.chat_mode,
credit_balance: self.credit_balance.as_ref(),
auto_topup: self.auto_topup.as_ref(),
usage_visible: self.usage_visible,
is_api_key_auth: self.is_api_key_auth,
changelog_bullets: &self.changelog_bullets,
changelog_has_full_notes: self.changelog_markdown.is_some(),
@@ -3384,8 +3120,6 @@ impl AppView {
self.welcome_import_banner_rect = result.import_banner_rect;
self.welcome_auth_url_rect = result.auth_url_rect;
self.welcome_auth_fallback_rect = result.auth_fallback_rect;
self.welcome_refresh_rect = result.refresh_rect;
self.welcome_gate_url_rect = result.gate_url_rect;
self.welcome_changelog_cta_rect = result.changelog_cta_rect;
self.session_picker_state.hit_areas = result.session_picker_hit_areas;
if let Some(modal) = self.import_claude_modal.as_mut() {
@@ -3427,9 +3161,6 @@ impl AppView {
&theme,
);
}
if !has_access && !self.access_gate_shown_logged {
self.access_gate_shown_logged = true;
}
if let Some(fps) = &fps_overlay {
fps.render(full_area, f.buffer_mut());
}
@@ -4474,24 +4205,9 @@ pub(crate) mod tests {
deferred_startup: Default::default(),
auth_use_oauth: false,
auth_clipboard_copied: false,
team_id: None,
team_name: None,
is_zdr: false,
team_role: None,
coding_data_retention_opt_out: false,
show_tips: None,
auto_update: None,
ask_user_question_timeout_enabled: None,
zdr_access_enabled: false,
usage_billing_redirect_url: None,
access_gate_shown_logged: false,
gate: None,
subscription_tier: None,
paywall_check_started: None,
last_subscription_check_at: None,
subscription_watch_interval_secs: None,
pending_gate_verification: None,
gate_verify_gen: 0,
bundle_state: BundleState::default(),
scroll_debug_hud: crate::views::scroll_debug_hud::ScrollDebugHud::new(),
fps_hud: crate::views::fps_hud::FpsHud::new(),
@@ -4513,8 +4229,6 @@ pub(crate) mod tests {
welcome_on_auth_url: false,
welcome_on_changelog_cta: false,
welcome_auth_fallback_rect: None,
welcome_refresh_rect: None,
welcome_gate_url_rect: None,
welcome_changelog_cta_rect: None,
auth_show_raw_url: false,
auth_mouse_disabled: false,
@@ -4555,13 +4269,8 @@ pub(crate) mod tests {
minimal_state: crate::minimal_api::MinimalState::default(),
reconnect_pending: false,
show_resolved_model: true,
sharing_enabled: false,
usage_visible: true,
tier_restricted_commands: Vec::new(),
leader_mode: true,
credit_balance: None,
auto_topup: None,
billing_poll_wanted: false,
leader_roster: Vec::new(),
dashboard_local_sessions: Vec::new(),
dashboard_sessions_loading: false,
@@ -4600,8 +4309,6 @@ pub(crate) mod tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -4791,8 +4498,6 @@ pub(crate) mod tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -5590,58 +5295,6 @@ pub(crate) mod tests {
assert!(!app.is_api_key_auth);
assert!(app.usage_visible);
}
/// Make every tier-restricted command visible on the welcome prompt so the
/// present/absent assertions exercise the deny list, not incidental
/// fail-closed hiding:
/// - `/imagine`, `/imagine-video` are `required_tools()`-gated, so advertise
/// their tools (otherwise the registry fail-closes them).
fn advertise_media_tools(app: &mut AppView) {
app.welcome_prompt
.slash_controller
.registry_mut()
.set_available_tools(
["image_gen", "image_to_video"]
.into_iter()
.map(str::to_string)
.collect(),
);
}
fn assert_tier_restricted_commands_present(app: &AppView) {
let reg = app.welcome_prompt.slash_controller.registry();
for name in TIER_RESTRICTED_COMMANDS {
assert!(
reg.get(name).is_some(),
"/{name} must be available when not tier-restricted (tools advertised)"
);
}
}
#[test]
fn apply_auth_meta_never_restricts_tiers() {
let mut app = test_app();
advertise_media_tools(&mut app);
app.apply_auth_meta(&kigi_shell::auth::AuthMeta::default());
assert!(app.tier_restricted_commands.is_empty());
assert_tier_restricted_commands_present(&app);
}
#[test]
fn is_restricted_tier_never_restricts() {
assert!(!is_restricted_tier(None));
assert!(!is_restricted_tier(Some("Free")));
assert!(!is_restricted_tier(Some("SomeFutureTier")));
}
#[test]
fn apply_auth_meta_clears_gate_on_login() {
let mut app = test_app();
app.gate = Some(kigi_shell::auth::GateInfo {
message: "Subscribe".into(),
url: None,
label: None,
});
assert!(app.is_access_blocked());
app.apply_auth_meta(&kigi_shell::auth::AuthMeta::default());
assert!(app.gate.is_none());
assert!(app.has_access());
}
#[test]
fn welcome_ctrl_q_requires_confirmation() {
let mut app = test_app();
crates/codegen/kigi-tui/src/app/cli.rs
+2 -5
View File
@@ -38,9 +38,6 @@ pub enum Command {
#[arg(long)]
json: bool,
},
/// Share a session and print the share URL
#[command(hide = true)]
Share(crate::share_cmd::ShareArgs),
/// Run any command with local clipboard support (OSC 52 → system clipboard).
#[cfg_attr(not(any(unix, windows)), command(hide = true))]
#[command(long_about = "\
@@ -268,8 +265,8 @@ pub struct AgentArgs {
#[arg(long, conflicts_with = "leader")]
pub no_leader: bool,
/// Override the CLI chat proxy base URL.
#[arg(long = "cli-chat-proxy-base-url")]
pub cli_chat_proxy_base_url: Option<String>,
#[arg(long = "coding-api-base-url")]
pub coding_api_base_url: Option<String>,
/// Override the public xAI API base URL.
#[arg(long = "xai-api-base-url")]
pub xai_api_base_url: Option<String>,
crates/codegen/kigi-tui/src/app/dispatch/auth.rs
+1 -22
View File
@@ -274,7 +274,7 @@ pub(super) fn handle_auth_complete(
app.auth_state = AuthState::Done;
app.auth_show_raw_url = false;
app.welcome_prompt_focused = !app.is_access_blocked();
app.welcome_prompt_focused = true;
app.auth_code_input.clear();
// Mid-session re-auth (`/login` or a 401 prompt): restore the
@@ -312,9 +312,6 @@ pub(super) fn handle_auth_complete(
}
}
let mut effects = dispatch(Action::RequestBundleStatus, app);
if app.usage_visible {
effects.push(Effect::FetchAppBilling);
}
effects.extend(retry_effects);
return effects;
}
@@ -322,27 +319,9 @@ pub(super) fn handle_auth_complete(
// status only; shell auto-syncs post-auth
let mut effects = dispatch(Action::RequestBundleStatus, app);
// Start auto-checking subscription if gated.
// Check immediately (don't wait 5s) then schedule the timer.
if !app.has_access() {
app.paywall_check_started = Some(std::time::Instant::now());
effects.push(Effect::CheckSubscription { verify: None });
effects.push(Effect::SchedulePaywallCheck);
}
// Fetch billing so the welcome screen can show a credit warning.
if app.usage_visible {
effects.push(Effect::FetchAppBilling);
}
// Fetch changelog (mirrors startup path for interactive login).
effects.push(Effect::FetchChangelog);
// ZDR-blocked users stay on the welcome screen — discard any
// deferred startup (they cannot start a session).
if app.is_zdr_blocked() {
clear_startup_actions(app);
return effects;
}
// Replay deferred session startup once BOTH gates are open. Auth
// is now Done, so `session_startup_allowed()` here means "is trust
// also resolved?" -- if trust is still Pending its question renders
crates/codegen/kigi-tui/src/app/dispatch/billing.rs
-532
View File
@@ -1,532 +0,0 @@
//! Subscription tier checks, credit-limit upsells, and auto-topup handling.
use super::queue::maybe_drain_queue;
use crate::app::actions::Effect;
use crate::app::agent::AgentId;
use crate::app::agent_view::AgentView;
use crate::app::app_view::AppView;
use crate::scrollback::block::RenderBlock;
use std::time::Duration;
/// How long the pager auto-checks subscription status before stopping.
/// After this, the user can still manually check via the [Refresh] button.
pub(super) const PAYWALL_AUTO_CHECK_TIMEOUT: Duration = Duration::from_secs(10 * 60);
/// Whether the user is at the highest subscription tier (SuperGrok Heavy).
///
/// Returns `true` only when `subscription_tier` **positively matches** a
/// known max-tier identifier. When the tier is unknown (`None`) or any
/// other value, returns `false` — the user gets the Q&A modal so lower-
/// tier users always see the upgrade option.
pub(super) fn is_max_tier(subscription_tier: Option<&str>) -> bool {
let Some(t) = subscription_tier else {
return false; // Unknown — default to Q&A.
};
// Normalize: lowercase + spaces→underscores to match both JWT-derived
// keys ("supergrok_heavy") and CCP display names ("SuperGrok Heavy").
t.to_ascii_lowercase().replace(' ', "_") == "supergrok_heavy"
}
/// URL for upgrading the subscription tier.
pub(crate) const UPSELL_URL_UPGRADE: &str = "https://grok.com/supergrok?referrer=grok-build";
/// URL for managing pay-as-you-go / on-demand spending / purchasing credits.
pub(crate) const UPSELL_URL_PAYG: &str = "https://grok.com?_s=usage";
/// Billing mode for credit-limit upsell copy.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(super) enum CreditLimitUpsellMode {
/// Unified usage pool — suggest purchasing prepaid credits.
UnifiedCredits,
/// Legacy on-demand / PAYG (`enabled` = on-demand cap already active).
LegacyPayg { enabled: bool },
}
/// Resolve upsell copy mode from credits config.
///
/// Prefers explicit `is_unified_billing_user` (`Option` — do not treat a
/// missing field as legacy). Positive `pay_as_you_go` (on-demand cap &gt; 0)
/// only selects legacy when the unified flag is absent. Unknown defaults to
/// unified (buy credits) so pool users never get “enable on-demand” wrongly.
pub(super) fn credit_limit_upsell_mode(
balance: Option<&crate::views::credit_bar::CreditBalance>,
) -> CreditLimitUpsellMode {
match balance {
Some(b) if b.is_unified_billing_user == Some(true) => CreditLimitUpsellMode::UnifiedCredits,
Some(b) if b.is_unified_billing_user == Some(false) => CreditLimitUpsellMode::LegacyPayg {
enabled: b.pay_as_you_go,
},
// Flag absent: only treat as legacy PAYG when we have a positive
// on-demand cap (pay_as_you_go is derived from cap &gt; 0).
Some(b) if b.pay_as_you_go => CreditLimitUpsellMode::LegacyPayg { enabled: true },
_ => CreditLimitUpsellMode::UnifiedCredits,
}
}
/// Whether an API / retry error is a credit-limit / spend-block denial.
///
/// - **402** Payment Required — always credit/spend block on this surface
/// (Build pool and IC spend blocks); no message filter.
/// - **403** — only when the body contains "run out of credits" (legacy IC
/// spend wording); other 403s (content-safety, ZDR, …) are excluded.
pub(crate) fn is_credit_limit_error(http_status: Option<u16>, message: &str) -> bool {
let m = message.to_ascii_lowercase();
let legacy = m.contains("run out of credits");
match http_status {
Some(402) => true,
Some(403) if legacy => true,
// Retry notifications embed "status 402" / "status 403" in the body
// without a separate status field.
None | Some(_) => m.contains("status 402") || (m.contains("status 403") && legacy),
}
}
/// Well-known error code CCP returns (HTTP 429, flat body
/// `{"code": "...", "error": "..."}`) when a free-tier user exhausts the
/// free usage quota. Kept in sync with the shared well-known error code
/// `SUBSCRIPTION_FREE_USAGE_EXHAUSTED`. sampling-types' `parse_error_bytes` prepends the flat
/// `code` to the flattened message, so the code reaches the pager embedded
/// in `RetryState::Exhausted.reason` and the -32003 error's data string.
pub(crate) const FREE_USAGE_EXHAUSTED_ERROR_CODE: &str = "subscription:free-usage-exhausted";
/// Whether a rate-limit error is the free-usage-quota exhaustion (paywall)
/// rather than transient throttling. Text-sniff on the flattened message,
/// same precedent as [`is_credit_limit_error`].
pub(crate) fn is_free_usage_exhausted_error(reason: &str) -> bool {
reason.contains(FREE_USAGE_EXHAUSTED_ERROR_CODE)
}
/// Whether a rate-limited (-32003) ACP error is the free-usage exhaustion.
/// `data` may be a bare string or the `{message, promptUsage?}` object
/// `attach_prompt_usage` produces — always read via the shared detail helper.
pub(crate) fn acp_error_is_free_usage_exhausted(err: &agent_client_protocol::Error) -> bool {
err.data
.as_ref()
.and_then(kigi_shell::sampling::error::error_detail_from_data)
.as_deref()
.is_some_and(is_free_usage_exhausted_error)
}
/// User-facing message for free-usage exhaustion. Shown by headless mode and
/// `format_acp_error` in place of auth-aware rate-limit copy. Deliberately
/// promises no reset duration — the quota window is backend-config-driven.
pub(crate) const FREE_USAGE_USER_MESSAGE: &str = "You\u{2019}ve reached your free Grok Build usage limit for now. Get SuperGrok for much higher limits, or try again later: https://grok.com/supergrok?referrer=grok-build";
/// Open the credit-limit upsell on the given agent.
///
/// **`max_tier = false`** (default): shows the Q&A question modal with
/// two options ("Upgrade tier" + buy-credits or PAYG). Each option's `id`
/// carries the target URL so the submit handler is position-independent.
///
/// **`max_tier = true`** (positively identified as SuperGrok Heavy):
/// pushes an inline scrollback card (`CreditLimitBlock`) with a single
/// continue action. No Q&A modal — the user can't upgrade further.
pub(super) fn open_credit_limit_upsell(
agent: &mut AgentView,
mode: CreditLimitUpsellMode,
max_tier: bool,
) {
use crate::scrollback::blocks::CreditLimitCardAction;
let (heading, upgrade_tier_desc, secondary_label, secondary_desc, card_action): (
&str,
&str,
&str,
&str,
CreditLimitCardAction,
) = match mode {
CreditLimitUpsellMode::UnifiedCredits => (
"You hit your weekly limit.",
"Upgrade to a higher tier for more usage",
"Buy more credits",
"Purchase credits to keep using Grok Build",
CreditLimitCardAction::PurchaseCredits,
),
CreditLimitUpsellMode::LegacyPayg { enabled: true } => (
"You\u{2019}ve hit your spending cap.",
"Upgrade to a higher tier for more credits",
"Increase limit",
"Raise your pay-as-you-go spending cap",
CreditLimitCardAction::IncreasePaygLimit,
),
CreditLimitUpsellMode::LegacyPayg { enabled: false } => (
"You\u{2019}ve hit the credit limit for your plan.",
"Upgrade to a higher tier for more credits",
"Pay as you go",
"Enable pay-as-you-go credits for on-demand usage",
CreditLimitCardAction::EnablePayg,
),
};
// ── Max tier: inline scrollback card ─────────────────────────
if max_tier {
use crate::scrollback::block::RenderBlock;
agent.scrollback.push_block(RenderBlock::credit_limit_card(
heading,
card_action,
UPSELL_URL_PAYG,
));
return;
}
// ── Default: Q&A question modal with two options ────────────────
use crate::views::question_view::{LocalQuestionKind, QuestionViewState};
use kigi_tools::implementations::grok_build::ask_user_question::{Question, QuestionOption};
if agent.question_view.is_some() {
return;
}
let question = Question {
question: heading.into(),
options: vec![
QuestionOption {
label: "Upgrade tier".into(),
description: upgrade_tier_desc.into(),
preview: None,
id: Some(UPSELL_URL_UPGRADE.into()),
},
QuestionOption {
label: secondary_label.into(),
description: secondary_desc.into(),
preview: None,
id: Some(UPSELL_URL_PAYG.into()),
},
],
multi_select: Some(false),
id: None,
};
let stashed = agent.prompt.stash();
let state = QuestionViewState::new(
format!("credit-limit-upsell-{}", uuid::Uuid::new_v4()),
vec![question],
stashed,
)
.with_local_kind(LocalQuestionKind::CreditLimitUpsell)
.with_no_freeform();
agent.question_view = Some(state);
agent.prompt.set_text("");
}
/// Open the free-usage paywall on the given agent: a Q&A modal in the
/// [`open_credit_limit_upsell`] style with two upgrade options. Each
/// option's `id` carries its target URL so the submit handler is
/// position-independent.
///
/// Driver-only by construction (called from the PromptResponse handler,
/// which viewers never receive).
pub(super) fn open_free_usage_upsell(agent: &mut AgentView) {
open_supergrok_upsell(agent, UpsellReason::FreeUsageLimit);
}
/// Open the SuperGrok upsell for a tier-restricted slash command
/// (`/usage`, `/imagine`, …). Returns whether the modal opened (`false`
/// when another question modal is already up) so the caller can decide
/// whether to consume the input that triggered it.
pub(super) fn open_restricted_command_upsell(agent: &mut AgentView) -> bool {
open_supergrok_upsell(agent, UpsellReason::RestrictedCommand)
}
/// Which situation opened the SuperGrok upsell modal. Controls the heading.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(super) enum UpsellReason {
/// Free-usage quota exhausted (429 paywall).
FreeUsageLimit,
/// A tier-restricted slash command was invoked.
RestrictedCommand,
}
/// Shared builder behind [`open_free_usage_upsell`] /
/// [`open_restricted_command_upsell`]: a Q&A modal in the
/// [`open_credit_limit_upsell`] style. Upgrade options carry their target
/// URL in the option `id` (position-independent submit handling).
fn open_supergrok_upsell(agent: &mut AgentView, reason: UpsellReason) -> bool {
use crate::views::question_view::{LocalQuestionKind, QuestionViewState};
use kigi_tools::implementations::grok_build::ask_user_question::{Question, QuestionOption};
// Never displace an already-open question modal. Callers that consume
// input on open must check this `false` and keep the input instead.
if agent.question_view.is_some() {
return false;
}
let (heading, modal_id_prefix) = match reason {
UpsellReason::FreeUsageLimit => ("You hit your free usage limit.", "free-usage-upsell"),
UpsellReason::RestrictedCommand => (
"Unlock all features with SuperGrok.",
"restricted-command-upsell",
),
};
let options = vec![
QuestionOption {
label: "Upgrade to SuperGrok".into(),
description: "For everyday coding and productivity tasks".into(),
preview: None,
id: Some(UPSELL_URL_UPGRADE.into()),
},
QuestionOption {
label: "Upgrade to SuperGrok Heavy".into(),
description: "Get the most out of Grok Build. Highest usage limits.".into(),
preview: None,
// No Heavy-specific URL exists; the /supergrok page lists
// both plans, so both upgrade options land there.
id: Some(UPSELL_URL_UPGRADE.into()),
},
];
let question = Question {
question: heading.into(),
options,
multi_select: Some(false),
id: None,
};
let stashed = agent.prompt.stash();
let state = QuestionViewState::new(
format!("{modal_id_prefix}-{}", uuid::Uuid::new_v4()),
vec![question],
stashed,
)
.with_local_kind(LocalQuestionKind::FreeUsageUpsell)
.with_no_freeform();
agent.question_view = Some(state);
agent.prompt.set_text("");
true
}
/// Apply an [`AutoTopupFetch`] outcome to a cached `auto_topup` slot: `Resolved`
/// sets it, `Cleared` resets it to "unknown" (no credits), and `Unchanged` keeps
/// the last-known-good value (the fetch failed).
pub(super) fn apply_auto_topup(
slot: &mut Option<crate::views::credit_bar::AutoTopupInfo>,
fetch: &crate::views::credit_bar::AutoTopupFetch,
) {
use crate::views::credit_bar::AutoTopupFetch;
match fetch {
AutoTopupFetch::Resolved(rule) => *slot = Some(rule.clone()),
AutoTopupFetch::Cleared => *slot = None,
AutoTopupFetch::Unchanged => {}
}
}
// TaskResult handlers.
pub(super) fn handle_billing_fetched(
app: &mut AppView,
agent_id: AgentId,
balance: Option<crate::views::credit_bar::CreditBalance>,
silent: bool,
subscription_tier: Option<String>,
autotopup: crate::views::credit_bar::AutoTopupFetch,
) -> Vec<Effect> {
// Parse/transport failures route to `BillingError`, so a `None`
// balance here means the response carried no billing config. Clear
// the cached balance + polling so the status bar agrees with the
// "No billing data available." message rather than showing a stale
// value.
app.credit_balance = balance.clone();
// `Resolved` updates the cached rule, `Cleared` resets it to unknown
// (no credits), `Unchanged` keeps the last-known-good (fetch failed).
apply_auto_topup(&mut app.auto_topup, &autotopup);
app.billing_poll_wanted = balance
.as_ref()
.map(|b| b.usage_pct >= 99.0)
.unwrap_or(false);
if let Some(tier) = subscription_tier {
app.subscription_tier = Some(tier);
}
// Render the `/usage` summary from the now-current cached rule.
let summary_topup = app.auto_topup.clone();
if let Some(agent) = app.agents.get_mut(&agent_id) {
// Gateway/chat-kind: do not attach Build coding credits.
let mut topup = agent.auto_topup.clone();
apply_auto_topup(&mut topup, &autotopup);
agent.apply_credit_balance(balance.clone(), topup);
if !silent && !agent.chat_kind {
let msg = match &balance {
Some(bal) => {
crate::views::credit_bar::format_usage_summary(bal, summary_topup.as_ref())
}
None => "No billing data available.".to_string(),
};
agent.scrollback.push_block(RenderBlock::System(
crate::scrollback::blocks::SystemMessageBlock::new(msg),
));
}
}
vec![]
}
pub(super) fn handle_gate_refreshed(
app: &mut AppView,
settings: Option<kigi_shell::util::config::RemoteSettings>,
) -> Vec<Effect> {
let Some(rs) = settings else {
return vec![];
};
app.usage_billing_redirect_url = rs.usage_billing_redirect_url.clone();
if let Some(secs) = rs.subscription_watch_interval_secs {
app.subscription_watch_interval_secs = Some(secs);
}
match AppView::gate_from_settings(&rs) {
Some(gate) => app.impose_gate(gate),
None => app.lift_gate(),
}
}
/// `x.ai/auth/check_subscription` completed. Meta is authoritative
/// (`apply_auth_meta` also drops any deferred gate). A failed check only
/// promotes the deferred gate it was verifying (`verify` generation);
/// generic watch/focus/paywall-chain failures never touch it.
pub(super) fn handle_check_subscription_complete(
app: &mut AppView,
verify: Option<u64>,
meta: Option<serde_json::Value>,
) -> Vec<Effect> {
let was_blocked = !app.has_access();
let applied = match meta {
Some(meta_val) => {
match serde_json::from_value::<kigi_shell::auth::AuthMeta>(meta_val) {
Ok(auth_meta) => {
app.apply_auth_meta(&auth_meta);
true
}
Err(e) => {
// Shell sent meta we can't decode — a protocol bug, not
// a transient failure. The check result is lost, so a
// verify deferral falls through to promotion below.
crate::unified_log::error(
"subscription.check.meta_parse_failed",
None,
Some(serde_json::json!({
"verify": verify,
"error": e.to_string(),
})),
);
false
}
}
}
// meta: None = shell reports "not authenticated" or the check RPC
// failed (already logged as subscription.check.rpc_failed).
None => false,
};
if !applied && let Some(generation) = verify {
app.promote_deferred_gate(generation, "check_failed");
}
crate::unified_log::info(
"subscription.check.complete",
None,
Some(serde_json::json!({
"verify": verify,
"meta_applied": applied,
"was_blocked": was_blocked,
"gated": !app.has_access(),
"tier": app.subscription_tier,
})),
);
maybe_start_paywall_chain(app, was_blocked)
}
/// Safety net for a hung verification check: show the still-pending
/// deferred gate (err on blocking).
pub(super) fn handle_gate_verify_timeout(app: &mut AppView, generation: u64) -> Vec<Effect> {
let was_blocked = !app.has_access();
app.promote_deferred_gate(generation, "verify_timeout");
maybe_start_paywall_chain(app, was_blocked)
}
/// Arm the 5s paywall auto-check chain on an ungated→gated transition, so a
/// paywall shown by verify-before-paywall self-lifts exactly like the
/// login-path one. Guarded so steady-state paywall-poller responses and
/// repeated checks can't fan out extra timers.
fn maybe_start_paywall_chain(app: &mut AppView, was_blocked: bool) -> Vec<Effect> {
if !was_blocked && !app.has_access() && app.paywall_check_started.is_none() {
app.paywall_check_started = Some(std::time::Instant::now());
return vec![Effect::SchedulePaywallCheck];
}
vec![]
}
pub(super) fn handle_credit_limit_recheck_complete(
app: &mut AppView,
agent_id: AgentId,
meta: Option<serde_json::Value>,
) -> Vec<Effect> {
if let Some(meta_val) = meta
&& let Ok(auth_meta) = serde_json::from_value::<kigi_shell::auth::AuthMeta>(meta_val)
{
app.apply_auth_meta(&auth_meta);
}
let Some(agent) = app.agents.get_mut(&agent_id) else {
return vec![];
};
// If the user already submitted another prompt while the
// recheck was in flight, don't show the upsell — they've moved on.
let user_moved_on = !agent.session.state.is_idle() || !agent.session.pending_prompts.is_empty();
if !user_moved_on {
let balance = agent
.credit_balance
.as_ref()
.or(app.credit_balance.as_ref());
let mode = credit_limit_upsell_mode(balance);
let max_tier = is_max_tier(app.subscription_tier.as_deref());
open_credit_limit_upsell(agent, mode, max_tier);
}
// Either way, drop the stashed prompt.
agent.credit_limit_stashed_prompt = None;
let mut effects = maybe_drain_queue(agent);
effects.push(Effect::FetchBilling {
agent_id,
silent: true,
});
effects
}
// Action handlers.
pub(super) fn dispatch_open_supergrok_url(app: &mut AppView) -> Vec<Effect> {
let url = app
.gate
.as_ref()
.and_then(|g| g.url.as_deref())
.unwrap_or("https://grok.com/supergrok?referrer=grok-build");
// Funnel attribution: tag CLI-originated SuperGrok upsell clicks
// with `referrer=grok-build`, matching the OAuth consent flow and
// x.ai/cli marketing links. Applied even when the URL came from
// remote settings's `gate_url`, so we don't depend on the remote flag
// being correctly configured. If the URL already specifies a
// referrer it's left alone.
let url = crate::app::link_opener::ensure_query_param(url, "referrer", "grok-build");
crate::app::link_opener::open_url(&url);
vec![]
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn free_usage_dual_read_string_and_wrapped_object_data() {
let free = "subscription:free-usage-exhausted quota hit";
let string_err = agent_client_protocol::Error::new(-32003, "Rate limited").data(free);
assert!(acp_error_is_free_usage_exhausted(&string_err));
// attach_prompt_usage wraps string data as {"message": ..., "promptUsage": ...}.
let wrapped =
agent_client_protocol::Error::new(-32003, "Rate limited").data(serde_json::json!({
"message": free,
"promptUsage": { "inputTokens": 1, "outputTokens": 0, "numTurns": 1 }
}));
assert!(acp_error_is_free_usage_exhausted(&wrapped));
assert!(!wrapped.data.as_ref().unwrap().is_string());
let other = agent_client_protocol::Error::new(-32003, "Rate limited").data("throttled");
assert!(!acp_error_is_free_usage_exhausted(&other));
}
}
crates/codegen/kigi-tui/src/app/dispatch/dashboard.rs
+2 -21
View File
@@ -48,7 +48,7 @@ pub(super) fn ensure_dashboard_state(app: &mut AppView) {
state.adopt_slash_mru(app.slash_mru.clone());
state.set_screen_mode(app.screen_mode);
state.set_recap_visible(app.session_recap_available);
state.set_restricted_commands(&app.tier_restricted_commands);
state.set_restricted_commands(&[]);
app.dashboard = Some(state);
}
@@ -144,7 +144,7 @@ pub(super) fn dispatch_open_dashboard(app: &mut AppView) -> Vec<Effect> {
// Subsequent reopen — just gc dead ids; in-memory state stays.
d.gc_stale_refs(&dashboard_alive_fn(&app.agents));
d.set_recap_visible(app.session_recap_available);
d.set_restricted_commands(&app.tier_restricted_commands);
d.set_restricted_commands(&[]);
}
// Refresh each local agent's git context (branch / worktree / label)
// from disk so the row subtitles show the LATEST branch and worktree
@@ -1207,7 +1207,6 @@ pub(super) fn dispatch_dashboard_dispatch_slash(app: &mut AppView, text: String)
return vec![];
}
let coding_data_sharing_opt_out_from_app = app.coding_data_retention_opt_out;
let show_tips_from_app = app.show_tips;
let auto_update_from_app = app.auto_update;
let respect_manual_folds_from_app = app.appearance.scrollback.scroll.respect_manual_folds;
@@ -1231,23 +1230,6 @@ pub(super) fn dispatch_dashboard_dispatch_slash(app: &mut AppView, text: String)
};
let reg = dashboard.dispatch.slash_controller.registry();
// Tier-restricted commands stay visible for discoverability but must
// not execute — and must not fall through to the unknown-command
// path below (which would spawn a session with the raw slash text as
// its first prompt). The dashboard has no question-modal surface, so
// upsell via the feedback toast.
if reg.is_restricted(invocation.token) {
let token = invocation.token.to_string();
if let Some(d) = app.dashboard.as_mut() {
d.dispatch.set_text("");
d.set_error_toast(&format!(
"/{token} requires SuperGrok — upgrade at {}",
super::billing::UPSELL_URL_UPGRADE
));
}
return vec![];
}
let Some(command) = reg.get(invocation.token).cloned() else {
// Unknown command. Fall back to the regular dispatch
// path so the text becomes a new session's prompt.
@@ -1295,7 +1277,6 @@ pub(super) fn dispatch_dashboard_dispatch_slash(app: &mut AppView, text: String)
.iter()
.map(|(id, info)| (info.name.clone(), id.clone()))
.collect(),
coding_data_sharing_opt_out: coding_data_sharing_opt_out_from_app,
plan_mode_active: false,
show_tips: show_tips_from_app,
auto_update: auto_update_from_app,
crates/codegen/kigi-tui/src/app/dispatch/mod.rs
-5
View File
@@ -13,7 +13,6 @@
//! otherwise); tests/ shares a fixture prelude via `use super::*;`.
mod auth;
mod billing;
mod ctx;
mod dashboard;
mod import_claude;
@@ -33,10 +32,6 @@ mod task_result;
mod transcript;
mod turn;
pub(crate) use billing::{
FREE_USAGE_USER_MESSAGE, UPSELL_URL_PAYG, UPSELL_URL_UPGRADE,
acp_error_is_free_usage_exhausted, is_credit_limit_error, is_free_usage_exhausted_error,
};
pub(crate) use modes::{downgrade_displayed_auto_if_gated, effective_auto};
pub(crate) use notes::{recap_unavailable_toast, scrollback_has_user_messages};
pub(crate) use permissions::resolve_permission_queue_transition;
crates/codegen/kigi-tui/src/app/dispatch/prompt.rs
+5 -128
View File
@@ -1,7 +1,6 @@
//! Prompt and bash-command submission dispatchers and reload-window helpers.
use super::auth::{scrollback_has_recent_context_too_large, scrollback_has_recent_reauth_prompt};
use super::billing::is_credit_limit_error;
use super::ctx::with_active_agent;
use super::interject;
use super::permissions::drain_permission_queue;
@@ -292,7 +291,6 @@ pub(super) fn dispatch_send_prompt_inner(
return vec![];
};
// Capture app-level fields before the mut-borrow on `agent`.
let coding_data_sharing_opt_out_from_app = app.coding_data_retention_opt_out;
let show_tips_from_app = app.show_tips;
let auto_update_from_app = app.auto_update;
let respect_manual_folds_from_app = app.appearance.scrollback.scroll.respect_manual_folds;
@@ -324,37 +322,6 @@ pub(super) fn dispatch_send_prompt_inner(
let mut effects = Vec::new();
// ── Tier-restricted command upsell ─────────────────────────────
// Restricted commands (`/usage`, `/imagine`, …) are hidden from the
// registry's `get()`, so a typed invocation would otherwise fall
// through the unknown-command path below and leak to the model as a
// raw prompt. Upsell instead; genuinely unknown commands still pass
// through (shell/ACP commands depend on that).
if !literal
&& trimmed.starts_with('/')
&& let Some(invocation) = crate::slash::parse_invocation(trimmed)
&& agent
.prompt
.slash_controller
.registry()
.is_restricted(invocation.token)
{
// Only consume the composer when the upsell can actually open: with
// another question modal already up, `open_supergrok_upsell` would
// no-op and wiping the composer here would silently drop the typed
// text. Keep it instead so the user can resubmit after closing the
// modal — and never fall through to passthrough for restricted
// commands.
if agent.question_view.is_none() {
if consume_input {
agent.prompt.set_text("");
}
let opened = super::billing::open_restricted_command_upsell(agent);
debug_assert!(opened, "no modal was open, so the upsell must open");
}
return vec![];
}
// ── Registry-based slash command execution ─────────────────────
// If the text starts with `/`, run it through the slash registry.
// The registry resolves builtins, ACP-advertised commands, and
@@ -384,7 +351,6 @@ pub(super) fn dispatch_send_prompt_inner(
.iter()
.map(|(id, info)| (info.name.clone(), id.clone()))
.collect(),
coding_data_sharing_opt_out: coding_data_sharing_opt_out_from_app,
// Prefer optimistic pending over confirmed active.
plan_mode_active: agent.plan_mode_pending.unwrap_or(agent.plan_mode_active),
show_tips: show_tips_from_app,
@@ -1004,29 +970,11 @@ pub(super) fn handle_prompt_response(
None => expected_send_now.is_some(),
};
let rate_limited = agent.session.rate_limited;
// Fallback mirroring the credit-limit race guard below: if the retry
// notification lost the race with (or never reached) this
// PromptResponse, detect the free-usage code from the prompt error
// itself — the flattened 429 body embeds it.
let free_usage_blocked = agent.session.free_usage_blocked
|| result
.as_ref()
.err()
.is_some_and(|e| super::billing::is_free_usage_exhausted_error(e));
let model_incompatible = agent.session.model_incompatible;
// Context overflow: the RetryState handler already pushed the actionable
// block, so the generic TurnFailed + error toast are redundant. Derived
// from the scrollback (mirrors reauth), not a session flag.
let context_overflow = scrollback_has_recent_context_too_large(&agent.scrollback);
// Fallback: if the retry notification didn't set the flag,
// detect credit-limit denials (legacy 403 or pool 402) from
// the PromptResponse error + HTTP status. Covers races where
// the retry notification arrives after the PromptResponse.
let credit_limit_blocked = agent.session.credit_limit_blocked
|| result
.as_ref()
.err()
.is_some_and(|e| is_credit_limit_error(http_status, e));
// A 401/auth failure already surfaced an actionable
// `ReAuthRequired` prompt via the RetryState handler (which
// runs before this PromptResponse). Suppress the redundant
@@ -1055,12 +1003,7 @@ pub(super) fn handle_prompt_response(
);
}
// Stash the complete in-flight prompt before finish_turn clears it.
// Used by CreditLimitRecheckComplete to retry after a tier upgrade.
if credit_limit_blocked {
agent.credit_limit_stashed_prompt = agent.session.in_flight_prompt.clone();
}
// Likewise, stash the prompt from a turn that failed on an
// Stash the prompt from a turn that failed on an
// expired login (401 / re-auth). The AuthComplete handler
// auto-resubmits it after a successful mid-session re-auth.
// A non-rewindable turn (None) must not clobber an earlier stash.
@@ -1110,17 +1053,11 @@ pub(super) fn handle_prompt_response(
elapsed: Some(elapsed.unwrap_or_default()),
}),
(Err(_), _)
if rate_limited
|| free_usage_blocked
|| model_incompatible
|| credit_limit_blocked
|| reauth_prompted
|| context_overflow =>
if rate_limited || model_incompatible || reauth_prompted || context_overflow =>
{
// Skip TurnFailed when a dedicated prompt/modal shows instead
// (rate limit, free-usage paywall, model incompatibility,
// credit 403, 401 re-auth, or a terminal context-window
// overflow).
// (rate limit, model incompatibility, 401 re-auth, or a
// terminal context-window overflow).
None
}
(Err(err), _) => Some(SessionEvent::TurnFailed {
@@ -1147,9 +1084,7 @@ pub(super) fn handle_prompt_response(
}
(Err(err), _)
if !rate_limited
&& !free_usage_blocked
&& !model_incompatible
&& !credit_limit_blocked
&& !reauth_prompted
&& !context_overflow =>
{
@@ -1256,7 +1191,7 @@ pub(super) fn handle_prompt_response(
// Predicted-next-prompt (tab autocomplete): wipe any stale suggestion
// at every turn boundary. This must run before the reconnect /
// credit-limit early returns below, which skip the fetch gate
// paywall early returns below, which skip the fetch gate
// entirely — a prior ghost would otherwise survive those paths.
agent.prompt.prompt_suggestion.clear();
@@ -1271,60 +1206,6 @@ pub(super) fn handle_prompt_response(
return vec![];
}
// Credit-limit (403 legacy / 402 pool): strip stale error
// blocks, then do a one-shot subscription re-check. If the
// tier changed (user upgraded mid-session), the stashed
// prompt is retried automatically; otherwise the upsell
// is shown.
if credit_limit_blocked {
// Strip stale "Retry failed" / "Turn failed" error blocks
// that were pushed before the credit-limit was detected.
// Walk backwards from the end and remove matching events.
let mut to_remove = Vec::new();
for idx in (0..agent.scrollback.len()).rev() {
match agent.scrollback.entry(idx).map(|e| &e.block) {
Some(crate::scrollback::block::RenderBlock::SessionEvent(ev))
if matches!(
&ev.event,
SessionEvent::RetryFailed { .. } | SessionEvent::TurnFailed { .. }
) =>
{
to_remove.push(idx);
}
// Stop at the first non-error block.
Some(
crate::scrollback::block::RenderBlock::SessionEvent(_)
| crate::scrollback::block::RenderBlock::System(_),
) => continue,
_ => break,
}
}
for idx in to_remove {
agent.scrollback.remove_from(idx);
}
// Defer the upsell until the subscription re-check
// completes. Queue drain + billing fetch happen in the
// CreditLimitRecheckComplete handler.
if let Some(p) = pending_adoption {
agent.discard_pending_adoption_updates(&p.prompt_id);
}
return vec![Effect::CreditLimitRecheck { agent_id }];
}
// Free-usage paywall (429 + subscription:free-usage-exhausted): the
// RetryState handler set the flag and suppressed the generic
// rate-limit block; show the upsell modal. Driver-only by
// construction — viewers never receive a PromptResponse. No queue
// drain: queued prompts would fail on the same exhausted quota.
if free_usage_blocked {
super::billing::open_free_usage_upsell(agent);
if let Some(p) = pending_adoption {
agent.discard_pending_adoption_updates(&p.prompt_id);
}
return vec![];
}
// FIFO handoff: if a server-authoritative prompt drained
// into the running slot during this turn's teardown, adopt it
// now (finish_turn cleared current_prompt_id) and run the
@@ -1372,10 +1253,6 @@ pub(super) fn handle_prompt_response(
});
}
effects.push(Effect::FetchBilling {
agent_id,
silent: true,
});
return effects;
}
vec![]
crates/codegen/kigi-tui/src/app/dispatch/queue.rs
+6 -18
View File
@@ -876,13 +876,9 @@ mod tests {
kind: crate::app::agent::QueueEntryKind::Prompt,
};
// Turn ends → should NOT drain "second" (user is editing it), only FetchBilling.
// Turn ends → should NOT drain "second" (user is editing it).
let effects = dispatch(end_turn(), &mut app);
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
assert!(effects.is_empty(), "drain should be blocked: {effects:?}");
assert!(app.agents[&id].session.state.is_idle());
// "second" should still be in the queue.
assert_eq!(app.agents[&id].session.queue_len(), 2);
@@ -908,14 +904,10 @@ mod tests {
kind: crate::app::agent::QueueEntryKind::Prompt,
};
// Turn ends → should drain "second" (front, not being edited) + FetchBilling.
// Turn ends → should drain "second" (front, not being edited).
let effects = dispatch(end_turn(), &mut app);
assert_eq!(effects.len(), 2);
assert_eq!(effects.len(), 1);
assert!(matches!(&effects[0], Effect::SendPrompt { text, .. } if text == "second"));
assert!(matches!(
&effects[1],
Effect::FetchBilling { silent: true, .. }
));
// "third" should still be in queue.
assert_eq!(app.agents[&id].session.queue_len(), 1);
assert_eq!(app.agents[&id].session.pending_prompts[0].text, "third");
@@ -1809,13 +1801,9 @@ mod tests {
kind: crate::app::agent::QueueEntryKind::Prompt,
};
// End turn for p2 → should NOT drain p3 (being edited), only FetchBilling.
// End turn for p2 → should NOT drain p3 (being edited).
let effects = dispatch(end_turn(), &mut app);
assert_eq!(effects.len(), 1);
assert!(
matches!(&effects[0], Effect::FetchBilling { silent: true, .. }),
"drain should be blocked, only billing refresh"
);
assert!(effects.is_empty(), "drain should be blocked: {effects:?}");
assert_eq!(app.agents[&id].session.queue_len(), 2); // p3, p4
// Simulate user saving edited text.
crates/codegen/kigi-tui/src/app/dispatch/router.rs
+4 -27
View File
@@ -3,7 +3,6 @@ use super::auth::{
dispatch_cancel_login, dispatch_login, dispatch_logout, dispatch_submit_auth_code,
dispatch_switch_account,
};
use super::billing::dispatch_open_supergrok_url;
use super::ctx::{
active_agent_session_id, get_active_agent_mut, navigate_clearing_selection,
sync_sleep_inhibitor, with_active_agent, with_scrollback,
@@ -93,10 +92,9 @@ use super::settings::ui::{
dispatch_toggle_vim_mode,
};
use super::status::{
dispatch_copy_session_id, dispatch_open_gboom, dispatch_share_session,
dispatch_show_context_info, dispatch_show_privacy_info, dispatch_show_queue,
dispatch_copy_session_id, dispatch_open_gboom, dispatch_show_context_info, dispatch_show_queue,
dispatch_show_release_notes, dispatch_show_session_info, dispatch_show_tasks,
dispatch_show_usage, set_coding_data_sharing,
dispatch_show_usage,
};
use super::task_result::{dispatch_task_result, unregister_all_active_sessions};
use super::transcript::{
@@ -551,23 +549,7 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
if group_toggled {
return vec![];
}
let mut credit_card: Option<String> = None;
with_scrollback(app, |s| {
if let Some(idx) = s.selected()
&& let Some(entry) = s.entry(idx)
&& let crate::scrollback::block::RenderBlock::CreditLimit(ref blk) = entry.block
{
credit_card = Some(blk.url.clone());
}
});
if let Some(url) = credit_card {
crate::app::link_opener::open_url_if_safe(
&url,
crate::terminal::hyperlinks::SchemeFilter::Standard,
);
} else {
dispatch_open_block_viewer(app);
}
dispatch_open_block_viewer(app);
vec![]
}
Action::OpenExtensionsModal { tab } => {
@@ -789,7 +771,6 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
vec![Effect::FetchCatalogEntry { kind, name }]
}
Action::CycleMode => dispatch_cycle_mode(app),
Action::ShareSession => dispatch_share_session(app),
Action::ShowSessionInfo => dispatch_show_session_info(app),
Action::ShowReleaseNotes { title, content } => {
dispatch_show_release_notes(app, title, content)
@@ -809,8 +790,6 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
Action::SaveRememberNoteFromModal => dispatch_save_remember_note_from_modal(app),
Action::SendBtw(question) => dispatch_send_btw(app, question),
Action::SendRecap { auto } => dispatch_send_recap(app, auto),
Action::ShowPrivacyInfo => dispatch_show_privacy_info(app),
Action::SetCodingDataSharing { opted_in } => set_coding_data_sharing(app, opted_in),
Action::ToggleYolo => dispatch_toggle_yolo(app),
Action::ToggleMultiline => dispatch_toggle_multiline(app),
Action::ToggleCompactMode => dispatch_toggle_compact_mode(app),
@@ -873,8 +852,6 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
Action::PermissionCancel => dispatch_permission_cancel(app),
Action::Logout => dispatch_logout(app),
Action::SwitchAccount => dispatch_switch_account(app),
Action::CheckSubscription => vec![Effect::CheckSubscription { verify: None }],
Action::OpenSupergrokUrl => dispatch_open_supergrok_url(app),
Action::OpenUrl(url) => {
use crate::terminal::hyperlinks::SchemeFilter;
if url.starts_with("file://") {
@@ -894,7 +871,7 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
}
Action::OpenManagedConnectors => {
use crate::terminal::hyperlinks::SchemeFilter;
let url = crate::views::mcps_modal::managed_connectors_url(app.team_id.as_deref());
let url = crate::views::mcps_modal::managed_connectors_url(None);
crate::app::link_opener::open_url_if_safe(&url, SchemeFilter::Standard);
vec![]
}
crates/codegen/kigi-tui/src/app/dispatch/session/foreign.rs
+3 -22
View File
@@ -1,7 +1,6 @@
use crate::app::actions::Effect;
use crate::app::app_view::{AppView, SessionPickerEntry};
use crate::app::dispatch::ctx::get_active_agent_mut;
use crate::app::effects::ConversationsPartial;
use crate::views::modal::ActiveModal;
use crate::views::picker::PickerState;
use crate::views::session_picker::{
@@ -61,7 +60,6 @@ impl PickerSurface<'_> {
query: Option<String>,
chat_mode: bool,
empty_notice: String,
partial_notice: Option<&'static str>,
) -> Option<String> {
let anchor = self.capture_selection();
let is_search = query.is_some();
@@ -88,11 +86,7 @@ impl PickerSurface<'_> {
}
} else {
self.lanes.pending_notice = None;
if chat_mode {
partial_notice.map(str::to_owned)
} else {
None
}
None
};
self.restore_selection(anchor);
notice
@@ -188,7 +182,6 @@ pub(in crate::app::dispatch) fn dispatch_fetch_session_list(app: &mut AppView) -
pub(in crate::app::dispatch) fn handle_session_list_loaded(
app: &mut AppView,
sessions: Vec<SessionPickerEntry>,
partial: Option<ConversationsPartial>,
seq: u64,
query: Option<String>,
) -> Vec<Effect> {
@@ -196,18 +189,7 @@ pub(in crate::app::dispatch) fn handle_session_list_loaded(
return vec![];
}
app.session_picker_detail_generation += 1;
if let Some(partial) = partial {
crate::unified_log::warn(
"session.list.partial",
None,
Some(serde_json::json!({ "reason": format!("{partial:?}") })),
);
}
let empty_notice = partial.map_or_else(
|| "No sessions found for this directory".to_owned(),
|partial| partial.picker_notice().to_owned(),
);
let partial_notice = partial.map(ConversationsPartial::picker_notice);
let empty_notice = "No sessions found for this directory".to_owned();
let chat_mode = app.chat_mode;
let mut sessions = Some(sessions);
let mut notice = None;
@@ -242,7 +224,6 @@ pub(in crate::app::dispatch) fn handle_session_list_loaded(
query.clone(),
chat_mode,
empty_notice.clone(),
partial_notice,
);
}
}
@@ -260,7 +241,7 @@ pub(in crate::app::dispatch) fn handle_session_list_loaded(
grouped: app.session_picker_grouped,
current_repo,
}
.native_loaded(sessions, query, chat_mode, empty_notice, partial_notice);
.native_loaded(sessions, query, chat_mode, empty_notice);
}
if let Some(notice) = notice {
app.show_toast(&notice);
crates/codegen/kigi-tui/src/app/dispatch/session/fork.rs
+1 -12
View File
@@ -206,15 +206,8 @@ pub(in crate::app::dispatch) fn dispatch_fork_resolved(
.prompt
.set_contextual_hints(app.contextual_hints.undo, app.contextual_hints.plan_mode);
agent.set_session_recap_available(app.session_recap_available);
agent.apply_app_scoped_gates(
app.sharing_enabled,
app.usage_visible,
app.chat_mode,
app.screen_mode,
&app.tier_restricted_commands,
);
agent.apply_app_scoped_gates(app.usage_visible, app.chat_mode, app.screen_mode, &[]);
agent.chat_kind = parent_chat_kind;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent
.prompt
.slash_controller
@@ -353,7 +346,6 @@ pub(in crate::app::dispatch) fn dispatch_project_selected(
let chat_kind = consume_chat_kind(app);
if let Some(agent) = app.agents.get_mut(&id) {
agent.chat_kind = chat_kind;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
}
effects.push(Effect::CreateSession {
agent_id: id,
@@ -398,8 +390,6 @@ fn build_fork_placeholder(
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: app.bootstrap_acp_commands.clone(),
available_commands_generation: 1,
available_tools: None,
@@ -543,7 +533,6 @@ pub(in crate::app::dispatch) fn handle_worktree_forked(
}
let effective_chat = conversation_entry || app.chat_mode;
agent.chat_kind = effective_chat;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
return vec![Effect::LoadSession {
agent_id,
session_id: session_id_str,
crates/codegen/kigi-tui/src/app/dispatch/session/lifecycle.rs
+3 -31
View File
@@ -304,8 +304,6 @@ pub(in crate::app::dispatch) fn dispatch_new_session_inner_with_id(
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: app.bootstrap_acp_commands.clone(),
available_commands_generation: 1,
available_tools: None,
@@ -330,14 +328,7 @@ pub(in crate::app::dispatch) fn dispatch_new_session_inner_with_id(
.prompt
.set_contextual_hints(app.contextual_hints.undo, app.contextual_hints.plan_mode);
agent.set_session_recap_available(app.session_recap_available);
agent.apply_app_scoped_gates(
app.sharing_enabled,
app.usage_visible,
app.chat_mode,
app.screen_mode,
&app.tier_restricted_commands,
);
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent.apply_app_scoped_gates(app.usage_visible, app.chat_mode, app.screen_mode, &[]);
agent
.prompt
.slash_controller
@@ -353,7 +344,6 @@ pub(in crate::app::dispatch) fn dispatch_new_session_inner_with_id(
let chat_kind = consume_chat_kind(app);
if let Some(agent) = app.agents.get_mut(&agent_id) {
agent.chat_kind = chat_kind;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent.mcp_init_progress = Some(McpInitProgress {
total: 0,
connected: 0,
@@ -402,7 +392,7 @@ pub(in crate::app::dispatch) fn dispatch_trust_folder(app: &mut AppView) -> Vec<
/// `AuthComplete` uses, so whichever gate resolves last drains exactly once.
pub(in crate::app::dispatch) fn finish_trust(app: &mut AppView) -> Vec<Effect> {
app.trust_state = TrustState::Done;
app.welcome_prompt_focused = !app.is_access_blocked();
app.welcome_prompt_focused = true;
if app.session_startup_allowed() {
drain_startup_actions(app)
} else {
@@ -629,8 +619,6 @@ pub(in crate::app::dispatch) fn dispatch_new_worktree_session(
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: app.bootstrap_acp_commands.clone(),
available_commands_generation: 1,
available_tools: None,
@@ -667,15 +655,8 @@ pub(in crate::app::dispatch) fn dispatch_new_worktree_session(
.prompt
.set_contextual_hints(app.contextual_hints.undo, app.contextual_hints.plan_mode);
agent.set_session_recap_available(app.session_recap_available);
agent.apply_app_scoped_gates(
app.sharing_enabled,
app.usage_visible,
app.chat_mode,
app.screen_mode,
&app.tier_restricted_commands,
);
agent.apply_app_scoped_gates(app.usage_visible, app.chat_mode, app.screen_mode, &[]);
agent.chat_kind = chat_kind;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent
.prompt
.slash_controller
@@ -764,7 +745,6 @@ pub(in crate::app::dispatch) fn skip_picker_and_create_session(
let chat_kind = consume_chat_kind(app);
if let Some(agent) = app.agents.get_mut(&agent_id) {
agent.chat_kind = chat_kind;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent.mcp_init_progress = Some(McpInitProgress {
total: 0,
connected: 0,
@@ -836,10 +816,6 @@ pub(in crate::app::dispatch) fn handle_session_created(
session_id: session_id_clone.clone(),
});
effects.push(Effect::RefreshAvailableCommands { agent_id, cwd });
effects.push(Effect::FetchBilling {
agent_id,
silent: true,
});
if let Some((model_id, effort)) = deferred {
effects.push(Effect::SwitchModel {
agent_id,
@@ -916,10 +892,6 @@ pub(in crate::app::dispatch) fn handle_worktree_session_created(
session_id: session_id_clone.clone(),
});
effects.push(Effect::RefreshAvailableCommands { agent_id, cwd });
effects.push(Effect::FetchBilling {
agent_id,
silent: true,
});
if let Some((model_id, effort)) = deferred {
effects.push(Effect::SwitchModel {
agent_id,
crates/codegen/kigi-tui/src/app/dispatch/session/load.rs
+2 -25
View File
@@ -162,8 +162,6 @@ fn dispatch_load_session_ungated(
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: app.bootstrap_acp_commands.clone(),
available_commands_generation: 1,
available_tools: None,
@@ -195,15 +193,8 @@ fn dispatch_load_session_ungated(
agent_mut.session.start_command(AgentCommand::RestoreCode);
agent_mut.turn_started_at = Some(std::time::Instant::now());
}
agent_mut.apply_app_scoped_gates(
app.sharing_enabled,
app.usage_visible,
app.chat_mode,
app.screen_mode,
&app.tier_restricted_commands,
);
agent_mut.apply_app_scoped_gates(app.usage_visible, app.chat_mode, app.screen_mode, &[]);
agent_mut.chat_kind = chat_kind || app.chat_mode;
agent_mut.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent_mut
.prompt
.slash_controller
@@ -808,8 +799,6 @@ pub(in crate::app::dispatch) fn dispatch_load_session_with_restore(
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: app.bootstrap_acp_commands.clone(),
available_commands_generation: 1,
available_tools: None,
@@ -836,15 +825,8 @@ pub(in crate::app::dispatch) fn dispatch_load_session_with_restore(
.prompt
.set_contextual_hints(app.contextual_hints.undo, app.contextual_hints.plan_mode);
agent.set_session_recap_available(app.session_recap_available);
agent.apply_app_scoped_gates(
app.sharing_enabled,
app.usage_visible,
app.chat_mode,
app.screen_mode,
&app.tier_restricted_commands,
);
agent.apply_app_scoped_gates(app.usage_visible, app.chat_mode, app.screen_mode, &[]);
agent.chat_kind = app.chat_mode;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent
.prompt
.slash_controller
@@ -958,10 +940,6 @@ pub(in crate::app::dispatch) fn handle_session_loaded(
agent_id,
session_id: hydrate_sid.clone(),
});
effects.push(Effect::FetchBilling {
agent_id,
silent: true,
});
if let Some((model_id, effort)) = deferred {
agent.session.model_switch_pending = true;
effects.push(Effect::SwitchModel {
@@ -1110,7 +1088,6 @@ pub(in crate::app::dispatch) fn handle_session_restored(
supersede_open_reload_window(agent, agent_id, "SessionRestored");
agent.bind_session_id(sid);
agent.chat_kind = app.chat_mode;
agent.apply_credit_balance(app.credit_balance.clone(), app.auto_topup.clone());
agent.scrollback.push_block(RenderBlock::system(format!(
"Session restored. Loading {local_session_id}..."
)));
crates/codegen/kigi-tui/src/app/dispatch/settings/ui.rs
+1 -14
View File
@@ -44,7 +44,6 @@ pub(crate) fn refresh_open_settings_modals(app: &mut AppView) {
}
let ui_snapshot = app.current_ui.clone();
// Capture app-level fields before the mut-borrow loop.
let coding_data_sharing_opt_out_from_app = app.coding_data_retention_opt_out;
let show_tips_from_app = app.show_tips;
let auto_update_from_app = app.auto_update;
let respect_manual_folds_from_app = app.appearance.scrollback.scroll.respect_manual_folds;
@@ -76,7 +75,6 @@ pub(crate) fn refresh_open_settings_modals(app: &mut AppView) {
.iter()
.map(|(id, info)| (info.name.clone(), id.clone()))
.collect(),
coding_data_sharing_opt_out: coding_data_sharing_opt_out_from_app,
// Prefer optimistic pending over confirmed active.
plan_mode_active: agent.plan_mode_pending.unwrap_or(agent.plan_mode_active),
show_tips: show_tips_from_app,
@@ -110,7 +108,7 @@ pub(in crate::app::dispatch) fn dispatch_open_command_palette(app: &mut AppView)
return vec![];
}
agent.active_modal = Some(ActiveModal::CommandPalette {
entries: crate::views::modal::default_palette_entries(agent.sharing_enabled),
entries: crate::views::modal::default_palette_entries(),
// Type-to-find: open in input mode (matches Ctrl+P).
state: crate::views::picker::PickerState::input_active(),
window: crate::views::modal_window::ModalWindowState::new(),
@@ -149,7 +147,6 @@ pub(in crate::app::dispatch) fn dispatch_open_settings(app: &mut AppView) -> Vec
let registry = app.settings_registry.clone();
let ui_snapshot = app.current_ui.clone();
// Capture app-level fields before the mut-borrow on the agent.
let coding_data_sharing_opt_out_from_app = app.coding_data_retention_opt_out;
let show_tips_from_app = app.show_tips;
let auto_update_from_app = app.auto_update;
let respect_manual_folds_from_app = app.appearance.scrollback.scroll.respect_manual_folds;
@@ -187,7 +184,6 @@ pub(in crate::app::dispatch) fn dispatch_open_settings(app: &mut AppView) -> Vec
.iter()
.map(|(id, info)| (info.name.clone(), id.clone()))
.collect(),
coding_data_sharing_opt_out: coding_data_sharing_opt_out_from_app,
// Prefer optimistic pending over confirmed active.
plan_mode_active: agent.plan_mode_pending.unwrap_or(agent.plan_mode_active),
show_tips: show_tips_from_app,
@@ -657,7 +653,6 @@ pub(crate) fn build_pager_snapshot(app: &AppView) -> crate::settings::PagerLocal
auto_mode: agent_auto_mode(app),
current_model_name: agent_current_model_name(app),
available_models: agent_available_models(app),
coding_data_sharing_opt_out: app.coding_data_retention_opt_out,
plan_mode_active: agent_plan_mode(app),
show_tips: app.show_tips,
auto_update: app.auto_update,
@@ -793,14 +788,6 @@ pub(in crate::app::dispatch) fn action_for_reset(
}
// max_thoughts_width: direct round-trip.
("max_thoughts_width", SettingValue::Int(i)) => Some(Action::SetMaxThoughtsWidth(*i)),
// coding_data_sharing: "opt-in" / "opt-out" → bool.
// "opt-out" arm is a skew guard (default is "opt-in").
("coding_data_sharing", SettingValue::Enum("opt-in")) => {
Some(Action::SetCodingDataSharing { opted_in: true })
}
("coding_data_sharing", SettingValue::Enum("opt-out")) => {
Some(Action::SetCodingDataSharing { opted_in: false })
}
// plan_mode: "on" / "off" → PlanModeKind.
// "on" arm is a skew guard (default is "off").
("plan_mode", SettingValue::Enum("off")) => {
crates/codegen/kigi-tui/src/app/dispatch/status.rs
+62 -247
View File
@@ -1,7 +1,6 @@
//! Session status, sharing, privacy, usage, and info dispatchers.
//! Session status, privacy, usage, and info dispatchers.
use super::ctx::get_active_agent;
use super::settings::ui::refresh_open_settings_modals;
use crate::app::actions::Effect;
use crate::app::agent::AgentId;
use crate::app::agent_view::AgentView;
@@ -9,39 +8,6 @@ use crate::app::app_view::{ActiveView, AppView};
use crate::notifications::{NotificationEvent, NotificationEventKind};
use crate::scrollback::block::RenderBlock;
/// Toggle YOLO mode (auto-approve all permissions).
///
/// When turning ON: auto-approve all currently queued permissions and
/// restore the stashed prompt. Future incoming permissions will be
/// auto-approved in `handle_permission_request`.
///
/// Share the current session via a public URL.
///
/// Produces Effect::ShareSession which spawns an async ACP ext request.
/// On completion, TaskResult::ShareSessionComplete shows the URL in scrollback.
pub(super) fn dispatch_share_session(app: &mut AppView) -> Vec<Effect> {
if !app.sharing_enabled {
app.show_toast("Sharing is disabled");
return vec![];
}
let ActiveView::Agent(id) = app.active_view else {
return vec![];
};
let Some(agent) = app.agents.get_mut(&id) else {
return vec![];
};
let Some(session_id) = agent.session.session_id.clone() else {
// No active session — error should have been caught by slash command,
// but guard here just in case.
return vec![];
};
vec![Effect::ShareSession {
agent_id: id,
session_id,
}]
}
/// Show session info: fetch via x.ai/session/info and display in scrollback.
///
/// Produces Effect::ShowSessionInfo which spawns an async ACP ext request.
@@ -66,131 +32,6 @@ pub(super) fn dispatch_show_session_info(app: &mut AppView) -> Vec<Effect> {
}]
}
/// Show privacy and data retention status as a system message in scrollback.
///
/// Three-state display: Enterprise ZDR, coding data sharing opted out,
/// or opted in. Labels align with `CODING_DATA_SHARING_CHOICES` in
/// `settings/defs.rs` and the `coding_data_sharing_toast` format.
pub(super) fn dispatch_show_privacy_info(app: &mut AppView) -> Vec<Effect> {
let mut lines = Vec::new();
if app.is_zdr {
// Enterprise ZDR -- the team has disabled retention entirely.
lines.push(" Zero Data Retention: enabled");
lines.push(" Your data is not retained or used for training (ZDR enabled).");
} else if app.coding_data_retention_opt_out {
// Coding data sharing opted out -- matches desktop's "Privacy mode" state.
lines.push(" Privacy: privacy mode");
lines.push(" Your code data will not be trained on or used to improve the product.");
lines.push("");
lines.push(" Use /privacy opt-in to share data and help improve the product.");
} else {
// Coding data sharing opted in -- matches desktop's "Share data" state.
lines.push(" Privacy: share data");
lines.push(" Usage and code data may be used by SpaceXAI to improve the product.");
lines.push("");
lines.push(" Use /privacy opt-out to enable privacy mode.");
}
lines.push("");
lines.push(" Learn more: https://x.ai/legal");
let text = lines.join("\n");
push_system_to_any_agent(app, &text);
vec![]
}
/// State-only mutation for `coding_data_sharing`. SHELL-owned.
pub(super) fn set_coding_data_sharing_inner(app: &mut AppView, opted_in: bool) {
app.coding_data_retention_opt_out = !opted_in;
}
/// Set coding-data-sharing preference. SHELL-owned, auth-metadata-backed
/// (persists via ACP ext-request, NOT `~/.kigi/config.toml`).
pub(super) fn set_coding_data_sharing(app: &mut AppView, opted_in: bool) -> Vec<Effect> {
// ── Guard 1: Enterprise ZDR ──────────────────────────────────────
if app.is_zdr {
app.show_toast("\u{2717} Cannot change: Zero Data Retention enabled");
return vec![];
}
// ── Guard 2: Non-admin team member ───────────────────────────────
if app.team_name.is_some() {
let is_admin = app
.team_role
.as_deref()
.is_some_and(|r| r.eq_ignore_ascii_case("admin"));
if !is_admin {
app.show_toast("\u{2717} Data sharing is controlled by your team admin");
return vec![];
}
}
// ── Guard 3: an agent must exist to thread the ACP call through ──
let agent_id = match app.active_view {
crate::app::app_view::ActiveView::Agent(id) => id,
_ => match app.agents.keys().next().copied() {
Some(id) => id,
None => {
tracing::warn!(
target: "settings",
key = "coding_data_sharing",
opted_in,
"set_coding_data_sharing called with no agents — unreachable in \
practice; returning empty (no toast: app.show_toast would no-op)",
);
return vec![];
}
},
};
let prev = !app.coding_data_retention_opt_out;
// ── Idempotent path: toast but skip the ACP round-trip. ──────────
if prev == opted_in {
app.show_toast(&coding_data_sharing_toast(opted_in));
return vec![];
}
// ── Optimistic mutation: state, then UI feedback, then effect. ───
set_coding_data_sharing_inner(app, opted_in);
refresh_open_settings_modals(app);
app.show_toast(&coding_data_sharing_toast(opted_in));
tracing::info!(
target: "settings",
key = "coding_data_sharing",
opted_in,
"setting changed",
);
vec![Effect::SetCodingDataSharing {
agent_id,
opted_in,
rollback_to_opted_in: prev,
}]
}
/// Format the `Coding data sharing` toast. Asymmetric: opt-in
/// (privacy-degrading) uses ⚠ + consequence text; opt-out (safe
/// default) uses ✓. Uses display names from the registry catalog.
pub(super) fn coding_data_sharing_toast(opted_in: bool) -> String {
let display = display_for_coding_data_sharing_canonical(opted_in);
if opted_in {
// Privacy-degrading: warn glyph + spelled-out consequence.
format!(
"\u{26A0} Coding data sharing: {display} \u{2014} code samples may be retained \
for training"
)
} else {
// Safe default — uniform ✓ glyph.
format!("\u{2713} Coding data sharing: {display}")
}
}
/// Display string for the canonical bool. Keep aligned with
/// `CODING_DATA_SHARING_CHOICES` in `settings/defs.rs`.
fn display_for_coding_data_sharing_canonical(opted_in: bool) -> &'static str {
if opted_in { "Opt in" } else { "Opt out" }
}
/// Scrub an untrusted error string for toast display. Substitutes a
/// generic placeholder when the input exceeds 120 chars or contains
/// control / bidi-override characters (prevents escape-sequence
@@ -208,21 +49,6 @@ pub(super) fn scrub_error_for_toast(error: &str) -> String {
}
}
/// Push a system message to the active agent's scrollback, or to any available
/// agent if on the welcome screen.
fn push_system_to_any_agent(app: &mut AppView, msg: &str) {
let block = crate::scrollback::block::RenderBlock::system(msg.to_string());
if let ActiveView::Agent(id) = app.active_view
&& let Some(agent) = app.agents.get_mut(&id)
{
agent.scrollback.push_block(block);
return;
}
if let Some(agent) = app.agents.values_mut().next() {
agent.scrollback.push_block(block);
}
}
/// Show context info: fetch via x.ai/session/info and display rich breakdown.
///
/// Produces Effect::ShowContextInfo which spawns an async ACP ext request.
@@ -244,32 +70,73 @@ pub(super) fn dispatch_show_context_info(app: &mut AppView) -> Vec<Effect> {
}]
}
/// Show credit usage: fetch billing data and display inline.
/// `/usage` — fetch Kimi usage/quota rows and display them inline.
///
/// When the remote settings `grok_build_usage_redirect_url` flag is set (delivered via
/// RemoteSettings, targeted at personal-team users), skip the backend fetch and
/// just point the user at that URL instead. This is a kill switch for the
/// personal-team billing path while it is unreliable.
/// Produces [`Effect::FetchUsage`], which asks the shell's `x.ai/billing`
/// extension (`GET {base}/usages`); [`handle_usage_fetched`] renders the
/// rows as a system block in scrollback.
pub(super) fn dispatch_show_usage(app: &mut AppView) -> Vec<Effect> {
let ActiveView::Agent(id) = app.active_view else {
return vec![];
};
if let Some(url) = app.usage_billing_redirect_url.clone() {
if let Some(agent) = app.agents.get_mut(&id) {
agent.scrollback.push_block(RenderBlock::System(
crate::scrollback::blocks::SystemMessageBlock::new(format!(
"Please check your usage on {url}"
)),
));
}
return vec![];
vec![Effect::FetchUsage { agent_id: id }]
}
/// Render the `/usage` result: the fetched quota rows (kimi-cli
/// `usage.py` semantics — label, remaining-quota bar, percent left, reset
/// hint), "No usage data available." for an empty list, or the error.
pub(super) fn handle_usage_fetched(
app: &mut AppView,
agent_id: AgentId,
result: Result<Vec<kigi_shell::extensions::billing::UsageRow>, String>,
) -> Vec<Effect> {
let msg = match &result {
Ok(rows) if rows.is_empty() => "No usage data available.".to_string(),
Ok(rows) => format_usage_rows(rows),
Err(e) => format!("Couldn't fetch usage: {e}"),
};
if let Some(agent) = app.agents.get_mut(&agent_id) {
agent.scrollback.push_block(RenderBlock::system(msg));
}
// Non-silent fetch: the effect also pulls the auto top-up rule so the
// summary can render usage, prepaid credits, and auto top-up together.
vec![Effect::FetchBilling {
agent_id: id,
silent: false,
}]
vec![]
}
/// Width of the remaining-quota bar, matching kimi-cli's usage panel.
const USAGE_BAR_WIDTH: usize = 20;
/// Format usage rows as aligned text lines (kimi-cli `_format_row`
/// parity): `label [bar] N% left (reset hint)`. The percentage is
/// derived from `used`/`limit` only — a row without a positive limit
/// renders as 0% left with an empty bar, exactly like kimi-cli.
fn format_usage_rows(rows: &[kigi_shell::extensions::billing::UsageRow]) -> String {
let label_width = rows
.iter()
.map(|r| r.label.chars().count())
.max()
.unwrap_or(0)
.max(6);
let mut lines = vec!["API Usage".to_string()];
for row in rows {
let ratio = if row.limit <= 0 {
0.0
} else {
(row.limit - row.used).clamp(0, row.limit) as f64 / row.limit as f64
};
let filled = (ratio * USAGE_BAR_WIDTH as f64).round() as usize;
let filled = filled.min(USAGE_BAR_WIDTH);
let bar: String = "\u{2588}".repeat(filled) + &"\u{2591}".repeat(USAGE_BAR_WIDTH - filled);
let mut line = format!(
" {:<width$} [{bar}] {:.0}% left",
row.label,
ratio * 100.0,
width = label_width,
);
if let Some(hint) = &row.reset_hint {
line.push_str(&format!(" ({hint})"));
}
lines.push(line);
}
lines.join("\n")
}
/// Commit a one-line "update available" notice into the active agent's
@@ -366,58 +233,6 @@ pub(super) fn notify_session_ready(
// TaskResult handlers.
pub(super) fn handle_coding_data_sharing_updated(
app: &mut AppView,
agent_id: AgentId,
opted_in: bool,
) -> Vec<Effect> {
// Re-anchor mirror to server-confirmed value (defense-in-
// depth against server reshaping the boolean). `agent_id`
// discarded — privacy is app-level, not per-agent.
set_coding_data_sharing_inner(app, opted_in);
refresh_open_settings_modals(app);
// Re-toast on confirmation. Without this, a slow ACP
// round-trip would leave the user with only the
// optimistic toast (already faded) and no
// server-confirmed feedback.
app.show_toast(&coding_data_sharing_toast(opted_in));
tracing::info!(
target: "settings",
key = "coding_data_sharing",
?agent_id,
opted_in,
"ACP update confirmed; mirror re-anchored",
);
vec![]
}
pub(super) fn handle_coding_data_sharing_failed(
app: &mut AppView,
agent_id: AgentId,
error: String,
rollback_to_opted_in: bool,
) -> Vec<Effect> {
// Revert optimistic mutation: inner → refresh → toast.
//
// `agent_id` discarded — privacy is global.
set_coding_data_sharing_inner(app, rollback_to_opted_in);
refresh_open_settings_modals(app);
// Scrub long/unsafe error strings before toasting.
let scrubbed = scrub_error_for_toast(&error);
app.show_toast(&format!(
"\u{2717} Couldn't update coding data sharing: {scrubbed}"
));
tracing::warn!(
target: "settings",
key = "coding_data_sharing",
?agent_id,
rollback_to_opted_in,
%error,
"ACP update failed; reverted optimistic mutation",
);
vec![]
}
pub(super) fn handle_context_info_complete(
app: &mut AppView,
agent_id: AgentId,
crates/codegen/kigi-tui/src/app/dispatch/task_result.rs
+4 -92
View File
@@ -2,11 +2,6 @@
use super::auth::{
ensure_login_method, handle_auth_complete, handle_auth_url_ready, handle_mcp_auth_trigger_done,
};
use super::billing::{
PAYWALL_AUTO_CHECK_TIMEOUT, apply_auto_topup, handle_billing_fetched,
handle_check_subscription_complete, handle_credit_limit_recheck_complete,
handle_gate_refreshed, handle_gate_verify_timeout,
};
use super::ctx::{find_agent_by_session_id, get_active_agent_mut};
use super::notes::{handle_btw_response, handle_memory_note_saved};
use super::prompt::{
@@ -34,10 +29,7 @@ use super::session::load::{
handle_session_search_debounce_expired, remove_session_from_pickers,
};
use super::settings::ui::apply_setting_rollback;
use super::status::{
handle_coding_data_sharing_failed, handle_coding_data_sharing_updated,
handle_context_info_complete, scrub_error_for_toast,
};
use super::status::{handle_context_info_complete, handle_usage_fetched, scrub_error_for_toast};
use super::transcript::{
handle_hooks_list_loaded, handle_mcp_toggle_done, handle_plugins_list_loaded,
handle_skills_toggle_done,
@@ -224,33 +216,9 @@ pub(super) fn dispatch_task_result(result: TaskResult, app: &mut AppView) -> Vec
TaskResult::ForkSessionFailed { agent_id, error } => {
handle_fork_session_failed(app, agent_id, error)
}
TaskResult::BillingFetched {
agent_id,
balance,
silent,
subscription_tier,
autotopup,
} => handle_billing_fetched(app, agent_id, balance, silent, subscription_tier, autotopup),
TaskResult::BillingError {
agent_id,
error,
silent,
} => {
if !silent && let Some(agent) = app.agents.get_mut(&agent_id) {
agent.scrollback.push_block(RenderBlock::System(
crate::scrollback::blocks::SystemMessageBlock::new(format!(
"Billing error: {error}"
)),
));
}
vec![]
TaskResult::UsageFetched { agent_id, result } => {
handle_usage_fetched(app, agent_id, result)
}
TaskResult::AppBillingFetched { balance, autotopup } => {
app.credit_balance = balance;
apply_auto_topup(&mut app.auto_topup, &autotopup);
vec![]
}
TaskResult::GateRefreshed { settings } => handle_gate_refreshed(app, settings),
TaskResult::SessionLoaded {
agent_id,
session_id,
@@ -287,10 +255,9 @@ pub(super) fn dispatch_task_result(result: TaskResult, app: &mut AppView) -> Vec
} => handle_session_load_failed(app, agent_id, session_id, error),
TaskResult::SessionListLoaded {
sessions,
partial,
seq,
query,
} => handle_session_list_loaded(app, sessions, partial, seq, query),
} => handle_session_list_loaded(app, sessions, seq, query),
TaskResult::ForeignSessionsScanned { entries, seq } => {
handle_foreign_sessions_scanned(app, entries, seq)
}
@@ -606,29 +573,6 @@ pub(super) fn dispatch_task_result(result: TaskResult, app: &mut AppView) -> Vec
TaskResult::SkillsToggleDone { agent_id, result } => {
handle_skills_toggle_done(app, agent_id, result)
}
TaskResult::ShareSessionComplete {
agent_id,
share_url,
} => {
if let Some(agent) = app.agents.get_mut(&agent_id) {
agent
.scrollback
.push_block(crate::scrollback::block::RenderBlock::system(format!(
"Session shared: {share_url}"
)));
}
vec![]
}
TaskResult::ShareSessionFailed { agent_id, error } => {
if let Some(agent) = app.agents.get_mut(&agent_id) {
agent
.scrollback
.push_block(crate::scrollback::block::RenderBlock::system(format!(
"Couldn't share session: {error}"
)));
}
vec![]
}
TaskResult::SessionAgentNameResolved {
agent_id,
agent_name,
@@ -668,14 +612,6 @@ pub(super) fn dispatch_task_result(result: TaskResult, app: &mut AppView) -> Vec
}
vec![]
}
TaskResult::CodingDataSharingUpdated { agent_id, opted_in } => {
handle_coding_data_sharing_updated(app, agent_id, opted_in)
}
TaskResult::CodingDataSharingFailed {
agent_id,
error,
rollback_to_opted_in,
} => handle_coding_data_sharing_failed(app, agent_id, error, rollback_to_opted_in),
TaskResult::RenameSessionComplete { agent_id, title } => {
if let Some(agent) = app.agents.get_mut(&agent_id) {
let safe = crate::views::session_title::sanitize_display_text(&title);
@@ -873,32 +809,8 @@ pub(super) fn dispatch_task_result(result: TaskResult, app: &mut AppView) -> Vec
app.auth_clipboard_copied = false;
vec![]
}
TaskResult::PaywallCheckTick => {
let timed_out = app
.paywall_check_started
.is_some_and(|t| t.elapsed() >= PAYWALL_AUTO_CHECK_TIMEOUT);
if !app.has_access() && !timed_out {
vec![
Effect::CheckSubscription { verify: None },
Effect::SchedulePaywallCheck,
]
} else {
vec![]
}
}
TaskResult::CheckSubscriptionComplete { verify, meta } => {
handle_check_subscription_complete(app, verify, meta)
}
TaskResult::GateVerifyTimeout { generation } => handle_gate_verify_timeout(app, generation),
TaskResult::CreditLimitRecheckComplete { agent_id, meta } => {
handle_credit_limit_recheck_complete(app, agent_id, meta)
}
TaskResult::LogoutComplete => {
app.auth_state = AuthState::Pending { error: None };
app.access_gate_shown_logged = false;
app.gate = None;
app.pending_gate_verification = None;
app.last_subscription_check_at = None;
app.login_method_id = None;
ensure_login_method(app);
app.auth_clipboard_copied = false;
crates/codegen/kigi-tui/src/app/dispatch/tests/billing.rs
+65 -925
View File
File diff suppressed because it is too large Load Diff
crates/codegen/kigi-tui/src/app/dispatch/tests/dashboard.rs
-31
View File
@@ -1270,37 +1270,6 @@ fn dashboard_slash_model_stages_pending_model() {
);
}
/// A tier-restricted command typed into the dashboard dispatch input must
/// upsell via the feedback toast — not execute, and (crucially) not fall
/// through the unknown-command path, which would spawn a session whose
/// first prompt is the raw slash text.
#[serial_test::serial(KIGI_AGENT_DASHBOARD)]
#[test]
fn dashboard_slash_restricted_command_upsells_via_toast() {
let mut app = test_app();
app.tier_restricted_commands = vec!["imagine".to_string()];
open_dashboard(&mut app);
let effects = dispatch_dashboard_dispatch_slash(&mut app, "/imagine a sunset".into());
assert!(effects.is_empty(), "restricted command must not dispatch");
assert!(
app.agents.is_empty(),
"no session may be spawned for the raw slash text"
);
let toast = app
.dashboard
.as_ref()
.unwrap()
.error_toast
.as_deref()
.expect("restricted command must set the upsell toast");
assert!(
toast.contains("/imagine") && toast.contains("SuperGrok"),
"toast must carry the upsell: {toast}"
);
}
/// A slash command that fails (`CommandResult::Error`) surfaces on
/// the dashboard with the `✗` error prefix — command error strings
/// carry no glyph of their own, and the feedback badge paints the
crates/codegen/kigi-tui/src/app/dispatch/tests/mod.rs
-46
View File
@@ -15,10 +15,6 @@ mod status;
mod task_result;
mod transcript;
mod turn;
use super::billing::{
CreditLimitUpsellMode, credit_limit_upsell_mode, is_max_tier, open_credit_limit_upsell,
open_free_usage_upsell,
};
use super::ctx::{find_agent_by_session_id, get_active_agent, get_active_agent_mut};
use super::dashboard::{
apply_pending_dispatch_config, dispatch_dashboard_attach, dispatch_dashboard_begin_rename,
@@ -133,24 +129,9 @@ fn test_app() -> AppView {
deferred_startup: Default::default(),
auth_use_oauth: false,
auth_clipboard_copied: false,
team_id: None,
team_name: None,
is_zdr: false,
team_role: None,
coding_data_retention_opt_out: false,
show_tips: None,
auto_update: None,
ask_user_question_timeout_enabled: None,
zdr_access_enabled: false,
usage_billing_redirect_url: None,
access_gate_shown_logged: false,
gate: None,
subscription_tier: None,
paywall_check_started: None,
last_subscription_check_at: None,
subscription_watch_interval_secs: None,
pending_gate_verification: None,
gate_verify_gen: 0,
bundle_state: crate::app::bundle::BundleState::default(),
scroll_debug_hud: crate::views::scroll_debug_hud::ScrollDebugHud::new(),
fps_hud: crate::views::fps_hud::FpsHud::new(),
@@ -172,8 +153,6 @@ fn test_app() -> AppView {
welcome_on_auth_url: false,
welcome_on_changelog_cta: false,
welcome_auth_fallback_rect: None,
welcome_refresh_rect: None,
welcome_gate_url_rect: None,
welcome_changelog_cta_rect: None,
auth_show_raw_url: false,
auth_mouse_disabled: false,
@@ -213,13 +192,8 @@ fn test_app() -> AppView {
minimal_state: crate::minimal_api::MinimalState::default(),
reconnect_pending: false,
show_resolved_model: true,
sharing_enabled: false,
usage_visible: true,
tier_restricted_commands: Vec::new(),
leader_mode: true,
credit_balance: None,
auto_topup: None,
billing_poll_wanted: false,
leader_roster: Vec::new(),
dashboard_local_sessions: Vec::new(),
dashboard_sessions_loading: false,
@@ -262,8 +236,6 @@ fn make_test_agent_session(app: &AppView, id: AgentId, sid: &str) -> AgentSessio
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -446,8 +418,6 @@ fn insert_placeholder_agent(app: &mut AppView, id: AgentId) {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -591,8 +561,6 @@ fn two_agent_app_with_bg_task() -> AppView {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
@@ -895,17 +863,3 @@ fn reset_mouse_capture_enabled(on: bool) {
fn mouse_capture_is_enabled() -> bool {
crate::app::MOUSE_CAPTURE_ENABLED.load(std::sync::atomic::Ordering::Acquire)
}
/// Build a minimal `CreditBalance` for billing dispatch tests.
fn test_bal(usage_pct: f64) -> crate::views::credit_bar::CreditBalance {
crate::views::credit_bar::CreditBalance {
usage_pct,
effective_usage_pct: usage_pct,
period_end_display: None,
pay_as_you_go: false,
on_demand_cap_cents: None,
on_demand_used_cents: None,
prepaid_balance_cents: None,
period_type: None,
is_unified_billing_user: None,
}
}
crates/codegen/kigi-tui/src/app/dispatch/tests/prompt.rs
+21 -70
View File
@@ -733,13 +733,8 @@ fn turn_end_drains_next_queued_prompt() {
&mut app,
);
// No re-send (the prompt was already sent at enqueue time): only the
// billing refresh effect.
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
// No re-send (the prompt was already sent at enqueue time).
assert!(effects.is_empty(), "no effects expected: {effects:?}");
assert!(app.agents[&id].session.state.is_turn_running());
// current_prompt_id was handed off to the second prompt for correlation.
assert_eq!(
@@ -772,12 +767,8 @@ fn turn_end_with_empty_queue_stays_idle() {
&mut app,
);
// Silent billing refresh after turn completion.
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
// Turn completion produces no follow-up effects.
assert!(effects.is_empty(), "no effects expected: {effects:?}");
assert!(app.agents[&id].session.state.is_idle());
// Session event "Worked for" added.
assert_eq!(app.agents[&id].scrollback.len(), 1);
@@ -806,31 +797,19 @@ fn multiple_queued_prompts_drain_one_per_turn() {
})
};
// Turn end → drain "b" + FetchBilling.
// Turn end → drain "b".
let effects = dispatch(end_turn(), &mut app);
assert!(matches!(&effects[0], Effect::SendPrompt { text, .. } if text == "b"));
assert!(matches!(
&effects[1],
Effect::FetchBilling { silent: true, .. }
));
assert_eq!(app.agents[&id].session.queue_len(), 1);
// Turn end → drain "c" + FetchBilling.
// Turn end → drain "c".
let effects = dispatch(end_turn(), &mut app);
assert!(matches!(&effects[0], Effect::SendPrompt { text, .. } if text == "c"));
assert!(matches!(
&effects[1],
Effect::FetchBilling { silent: true, .. }
));
assert_eq!(app.agents[&id].session.queue_len(), 0);
// Turn end → FetchBilling only.
// Turn end with an empty queue → nothing to drain.
let effects = dispatch(end_turn(), &mut app);
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
assert!(effects.is_empty(), "no effects expected: {effects:?}");
assert!(app.agents[&id].session.state.is_idle());
}
@@ -852,12 +831,8 @@ fn prompt_response_resets_turn_state() {
}),
&mut app,
);
// Silent billing refresh after turn completion.
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
// Turn completion produces no follow-up effects.
assert!(effects.is_empty(), "no effects expected: {effects:?}");
assert!(app.agents[&id].session.state.is_idle());
assert!(app.agents[&id].turn_started_at.is_none());
// mark_turn_finished must stamp the activity anchor used by the
@@ -892,7 +867,7 @@ fn turn_end_fetches_prompt_suggestion_when_enabled() {
&mut app,
);
assert_eq!(effects.len(), 2, "suggestion fetch + billing: {effects:?}");
assert_eq!(effects.len(), 1, "suggestion fetch: {effects:?}");
let Effect::FetchPromptSuggestion {
agent_id,
generation,
@@ -1249,12 +1224,8 @@ fn turn_complete_notification_suppressed_when_queue_non_empty() {
}),
&mut app,
);
// No re-send; only billing refresh. The second prompt is adopted.
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
// No re-send. The second prompt is adopted.
assert!(effects.is_empty(), "no effects expected: {effects:?}");
assert!(app.agents[&id].session.state.is_turn_running());
assert!(
app.deferred_notification.is_none(),
@@ -1536,12 +1507,8 @@ fn prompt_response_resets_cancelling_to_idle() {
}),
&mut app,
);
// Silent billing refresh after turn completion.
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
// Turn completion produces no follow-up effects.
assert!(effects.is_empty(), "no effects expected: {effects:?}");
assert!(app.agents[&id].session.state.is_idle());
// Cancellation produces a "Turn cancelled" session event.
assert_eq!(app.agents[&id].scrollback.len(), 1);
@@ -1578,12 +1545,8 @@ fn cancel_with_queued_prompt_drains_on_completion() {
&mut app,
);
assert_eq!(effects.len(), 2);
assert_eq!(effects.len(), 1);
assert!(matches!(&effects[0], Effect::SendPrompt { text, .. } if text == "queued"));
assert!(matches!(
&effects[1],
Effect::FetchBilling { silent: true, .. }
));
assert!(app.agents[&id].session.state.is_turn_running());
assert_eq!(app.agents[&id].session.queue_len(), 0);
}
@@ -1605,12 +1568,8 @@ fn cancel_with_empty_queue_stays_idle() {
}),
&mut app,
);
// Silent billing refresh after turn completion.
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
// Turn completion produces no follow-up effects.
assert!(effects.is_empty(), "no effects expected: {effects:?}");
assert!(app.agents[&id].session.state.is_idle());
}
@@ -1660,12 +1619,8 @@ fn cancel_with_multiple_queued_prompts_drains_only_front_prompt() {
&mut app,
);
assert_eq!(effects.len(), 2);
assert_eq!(effects.len(), 1);
assert!(matches!(&effects[0], Effect::SendPrompt { text, .. } if text == "queued-1"));
assert!(matches!(
&effects[1],
Effect::FetchBilling { silent: true, .. }
));
assert!(app.agents[&id].session.state.is_turn_running());
assert_eq!(app.agents[&id].session.queue_len(), 1);
assert_eq!(app.agents[&id].session.pending_prompts[0].text, "queued-2");
@@ -1706,12 +1661,8 @@ fn cancel_drain_is_blocked_when_editing_front_prompt() {
&mut app,
);
// Drain blocked but billing refresh still happens.
assert_eq!(effects.len(), 1);
assert!(matches!(
&effects[0],
Effect::FetchBilling { silent: true, .. }
));
// Drain blocked — no effects.
assert!(effects.is_empty(), "drain should be blocked: {effects:?}");
assert!(app.agents[&id].session.state.is_idle());
assert_eq!(app.agents[&id].session.queue_len(), 2);
assert_eq!(app.agents[&id].session.pending_prompts[0].text, "queued-1");
crates/codegen/kigi-tui/src/app/dispatch/tests/session/foreign.rs
-4
View File
@@ -220,7 +220,6 @@ fn native_empty_waits_for_foreign_and_foreign_only_rows_survive() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![],
partial: None,
seq: 1,
query: None,
}),
@@ -267,7 +266,6 @@ fn foreign_empty_then_native_empty_finishes_once_without_resurrecting() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![],
partial: None,
seq: 3,
query: None,
}),
@@ -331,7 +329,6 @@ fn modal_empty_notice_waits_until_both_lanes_are_empty() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![],
partial: None,
seq: 9,
query: None,
}),
@@ -435,7 +432,6 @@ fn modal_selection_survives_native_and_foreign_completion_races() {
at(make_picker_entry("a", "/repo"), 20),
at(make_picker_entry("b", "/repo"), 10),
],
partial: None,
seq: 2,
query: None,
}),
crates/codegen/kigi-tui/src/app/dispatch/tests/session/fork.rs
+1 -22
View File
@@ -723,27 +723,14 @@ fn dispatch_fork_stashes_directive_in_pending_first_prompt() {
}
#[test]
fn dispatch_fork_inherits_appearance_sharing_and_plugin_visibility() {
fn dispatch_fork_inherits_appearance_and_plugin_visibility() {
let mut app = fork_test_app();
// Tweak app-level state so we can verify the sweep applied it.
app.appearance.prompt.compact = true;
app.sharing_enabled = false;
app.usage_visible = false;
app.appearance.disable_plugins = true;
// Cached billing state must be inherited so the credits warning is
// correct from the first frame (not just after a billing fetch).
app.credit_balance = Some(crate::views::credit_bar::CreditBalance {
prepaid_balance_cents: Some(1500),
..test_bal(50.0)
});
app.auto_topup = Some(crate::views::credit_bar::AutoTopupInfo {
enabled: true,
topup_amount_cents: Some(2000),
max_amount_cents: None,
});
dispatch(Action::Fork(fork_args(Some(false), None)), &mut app);
let new_agent = app.agents.get(&AgentId(1)).unwrap();
assert!(!new_agent.sharing_enabled);
assert!(
new_agent
.prompt
@@ -752,14 +739,6 @@ fn dispatch_fork_inherits_appearance_sharing_and_plugin_visibility() {
.get("usage")
.is_none()
);
assert_eq!(
new_agent
.credit_balance
.as_ref()
.and_then(|b| b.prepaid_balance_cents),
Some(1500)
);
assert!(new_agent.auto_topup.as_ref().is_some_and(|at| at.enabled));
}
#[test]
crates/codegen/kigi-tui/src/app/dispatch/tests/session/lifecycle.rs
+2 -11
View File
@@ -50,7 +50,7 @@ fn session_created_sets_session_id() {
}),
&mut app,
);
assert_eq!(effects.len(), 5);
assert_eq!(effects.len(), 4);
assert!(
matches!(& effects[0], Effect::FetchPromptHistory { session_id, .. } if
session_id == "new-session-123")
@@ -60,11 +60,7 @@ fn session_created_sets_session_id() {
&effects[2],
Effect::RefreshAvailableCommands { .. }
));
assert!(matches!(
&effects[3],
Effect::FetchBilling { silent: true, .. }
));
assert!(matches!(&effects[4], Effect::RegisterActiveSession { .. }));
assert!(matches!(&effects[3], Effect::RegisterActiveSession { .. }));
assert_eq!(
app.agents[&id]
.session
@@ -198,11 +194,6 @@ fn worktree_session_created_sets_session_and_cwd() {
.iter()
.any(|e| matches!(e, Effect::FetchSessionAgentName { .. }))
);
assert!(
effects
.iter()
.any(|e| matches!(e, Effect::FetchBilling { silent: true, .. }))
);
assert!(
effects
.iter()
crates/codegen/kigi-tui/src/app/dispatch/tests/session/load.rs
-13
View File
@@ -1836,7 +1836,6 @@ fn stale_session_list_responses_are_dropped() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-stale-1")],
partial: None,
seq: 1,
query: None,
}),
@@ -1861,7 +1860,6 @@ fn stale_session_list_responses_are_dropped() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-fresh-2")],
partial: None,
seq: 2,
query: Some("abcd".into()),
}),
@@ -1906,7 +1904,6 @@ fn modal_search_response_lands_and_stale_is_dropped() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-hit-1")],
partial: None,
seq: 1,
query: Some("hit".into()),
}),
@@ -1944,7 +1941,6 @@ fn modal_search_response_lands_and_stale_is_dropped() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-stale-m")],
partial: None,
seq: 1,
query: Some("hit".into()),
}),
@@ -1999,7 +1995,6 @@ fn modal_close_drops_in_flight_search_response() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-late-1")],
partial: None,
seq,
query: Some("hit".into()),
}),
@@ -2045,7 +2040,6 @@ fn modal_pick_drops_in_flight_search_response() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-late-p")],
partial: None,
seq,
query: Some("hit".into()),
}),
@@ -2089,7 +2083,6 @@ fn welcome_esc_drops_in_flight_fetch_response() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-late-w")],
partial: None,
seq,
query: None,
}),
@@ -2119,7 +2112,6 @@ fn build_mode_modal_close_does_not_invalidate_plain_fetch() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_picker_entry("build-late-1", "/tmp/repo")],
partial: None,
seq,
query: None,
}),
@@ -2142,7 +2134,6 @@ fn zero_hit_search_shows_empty_list_without_toast() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![],
partial: None,
seq: 1,
query: Some("zzz".into()),
}),
@@ -2163,7 +2154,6 @@ fn zero_hit_search_shows_empty_list_without_toast() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![],
partial: None,
seq: 2,
query: None,
}),
@@ -2347,7 +2337,6 @@ fn build_mode_list_response_preserves_deep_search_spinner() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_picker_entry("local-1", "/r")],
partial: None,
seq: app.session_picker_list_seq,
query: None,
}),
@@ -2400,7 +2389,6 @@ fn build_mode_rapid_plain_fetches_keep_last_write_wins() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_picker_entry("build-first", "/r")],
partial: None,
seq: 0,
query: None,
}),
@@ -2416,7 +2404,6 @@ fn build_mode_rapid_plain_fetches_keep_last_write_wins() {
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_picker_entry("build-second", "/r")],
partial: None,
seq: 0,
query: None,
}),
crates/codegen/kigi-tui/src/app/dispatch/tests/settings.rs
-5
View File
@@ -1209,9 +1209,6 @@ fn move_setting_away_from_default(app: &mut AppView, key: crate::settings::Setti
"max_thoughts_width" => {
let _ = dispatch(Action::SetMaxThoughtsWidth(200), app);
}
"coding_data_sharing" => {
let _ = dispatch(Action::SetCodingDataSharing { opted_in: false }, app);
}
"plan_mode" => {
let _ = dispatch(
Action::SetPlanMode(crate::app::actions::PlanModeKind::On),
@@ -1388,8 +1385,6 @@ fn set_simple_mode_propagates_to_every_agent() {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/dispatch/tests/status.rs
+1 -700
View File
@@ -1,4 +1,4 @@
//! Tests for session status, sharing, privacy, and coding-data-sharing dispatchers.
//! Tests for session status and sharing dispatchers.
use super::*;
@@ -60,659 +60,6 @@ fn send_while_idle_with_nonempty_shared_queue_routes_to_server() {
assert_eq!(q.last().map(|e| e.text.as_str()), Some("c"));
}
#[test]
fn show_privacy_info_zdr() {
let mut app = test_app_with_agent();
app.is_zdr = true;
let effects = dispatch(Action::ShowPrivacyInfo, &mut app);
assert!(effects.is_empty());
let text = last_system_text(&app, AgentId(0));
assert!(text.contains("Zero Data Retention"));
}
/// `/privacy` info-print uses the desktop-aligned "privacy mode" /
/// "share data" labels from the user's intentional rewrite.
#[test]
fn show_privacy_info_opted_out() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = true;
let effects = dispatch(Action::ShowPrivacyInfo, &mut app);
assert!(effects.is_empty());
let text = last_system_text(&app, AgentId(0));
assert!(
text.contains("Privacy: privacy mode"),
"info-print must use 'Privacy: privacy mode' (desktop-aligned label): {text}",
);
assert!(text.contains("/privacy opt-in"));
}
#[test]
fn show_privacy_info_opted_in() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = false;
let effects = dispatch(Action::ShowPrivacyInfo, &mut app);
assert!(effects.is_empty());
let text = last_system_text(&app, AgentId(0));
assert!(
text.contains("Privacy: share data"),
"info-print must use 'Privacy: share data' (desktop-aligned label): {text}",
);
assert!(text.contains("/privacy opt-out"));
}
/// The info-print uses desktop-aligned labels ("privacy mode" /
/// "share data"). This test pins those labels to catch accidental
/// regressions to the registry's "Opt in" / "Opt out" display
/// strings.
#[test]
fn show_privacy_info_does_not_use_old_desktop_labels() {
// opted-out → "Privacy: privacy mode"
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = true;
let _ = dispatch(Action::ShowPrivacyInfo, &mut app);
let text = last_system_text(&app, AgentId(0));
assert!(
text.contains("privacy mode"),
"[opted-out] info-print must contain 'privacy mode': {text:?}",
);
// opted-in → "Privacy: share data"
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = false;
let _ = dispatch(Action::ShowPrivacyInfo, &mut app);
let text = last_system_text(&app, AgentId(0));
assert!(
text.contains("share data"),
"[opted-in] info-print must contain 'share data': {text:?}",
);
}
// ── coding_data_sharing dispatch tests ───
//
// The dispatcher uses **optimistic + rollback + toast**, matching the
// `set_yolo_mode` pattern. These tests pin the contract:
// - Guards (ZDR, non-admin team) toast and short-circuit.
// - Idempotent dispatch toasts but emits no Effect.
// - Optimistic mutation flips `app.coding_data_retention_opt_out`
// BEFORE the Effect is emitted.
// - `Effect::SetCodingDataSharing` carries
// `rollback_to_opted_in = previous_value`.
// - `TaskResult::CodingDataSharingFailed` reverts the optimistic
// mutation; `TaskResult::CodingDataSharingUpdated` re-anchors
// to the server-confirmed value.
/// Idempotent re-dispatch when already opted-in toasts but emits
/// no Effect (avoids a wasted ACP round-trip).
///
/// Toast uses the **display name** ("Opt in", not the
/// snake-case canonical "opt-in") AND the **destructive `⚠`
/// glyph** on the opt-in direction (privacy-degrading).
#[test]
fn set_coding_data_sharing_idempotent_opt_in() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = false; // currently opted-in
let effects = dispatch(Action::SetCodingDataSharing { opted_in: true }, &mut app);
assert!(
effects.is_empty(),
"idempotent re-dispatch must NOT emit Effect"
);
let toast = read_toast(&app);
assert!(
toast.contains("Opt in"),
"toast must show display name 'Opt in' (PR 9 R1, General-3 Issue 6): {toast}",
);
assert!(
!toast.contains("opt-in"),
"toast must NOT use snake-case canonical 'opt-in' — display name only: {toast}",
);
assert!(
toast.contains('\u{26A0}'),
"idempotent opt-in toast uses ⚠ destructive-warning glyph (PR 9 R1, \
General-3 Issue 5): {toast}",
);
// State unchanged.
assert!(
!app.coding_data_retention_opt_out,
"idempotent path must not mutate state",
);
}
/// Idempotent re-dispatch when already opted-out toasts but emits
/// no Effect.
///
/// Opt-out direction uses the **uniform `✓` glyph**
/// (restoring the safe default) and the display name "Opt out".
#[test]
fn set_coding_data_sharing_idempotent_opt_out() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = true; // currently opted-out
let effects = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
assert!(
effects.is_empty(),
"idempotent re-dispatch must NOT emit Effect"
);
let toast = read_toast(&app);
assert!(
toast.contains("Opt out"),
"toast must show display name 'Opt out': {toast}",
);
assert!(
toast.contains('\u{2713}'),
"idempotent opt-out toast uses ✓ safe-default glyph: {toast}",
);
assert!(
!toast.contains('\u{26A0}'),
"opt-out is the safe direction — must NOT use ⚠: {toast}",
);
// State unchanged.
assert!(
app.coding_data_retention_opt_out,
"idempotent path must not mutate state",
);
}
/// ZDR teams are blocked from toggling. The blocked path
/// toasts (not scrollback) and short-circuits with no Effect.
#[test]
fn set_coding_data_sharing_blocked_by_zdr() {
let mut app = test_app_with_agent();
app.is_zdr = true;
app.coding_data_retention_opt_out = false;
let effects = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
assert!(effects.is_empty(), "ZDR block must NOT emit Effect");
let toast = read_toast(&app);
assert!(
toast.contains("Zero Data Retention"),
"ZDR toast must surface the policy: {toast}",
);
assert!(
toast.contains('\u{2717}'),
"blocked toast uses ✗ glyph: {toast}"
);
// State unchanged — the user was blocked, the optimistic
// mutation never happened.
assert!(
!app.coding_data_retention_opt_out,
"ZDR block must not mutate state",
);
}
/// ZDR block fires even when the toggle would be a no-op
/// (defense-in-depth: don't quietly accept a same-value toggle
/// from a user the policy says shouldn't be touching this).
#[test]
fn set_coding_data_sharing_blocked_by_zdr_even_if_idempotent() {
let mut app = test_app_with_agent();
app.is_zdr = true;
app.coding_data_retention_opt_out = false;
let effects = dispatch(Action::SetCodingDataSharing { opted_in: true }, &mut app);
assert!(effects.is_empty());
assert!(read_toast(&app).contains("Zero Data Retention"));
}
/// Non-admin team members are blocked from toggling (matches
/// desktop). The blocked path toasts and short-circuits.
#[test]
fn set_coding_data_sharing_blocked_non_admin() {
let mut app = test_app_with_agent();
app.team_name = Some("Acme".into());
app.team_role = Some("Member".into());
app.coding_data_retention_opt_out = false;
let effects = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
assert!(effects.is_empty());
let toast = read_toast(&app);
assert!(
toast.contains("team admin"),
"non-admin toast must mention team admin: {toast}",
);
}
/// Admin team members CAN toggle. The admin-allowed path produces
/// an Effect carrying the rollback value.
#[test]
fn set_coding_data_sharing_allowed_for_admin() {
let mut app = test_app_with_agent();
app.team_name = Some("Acme".into());
app.team_role = Some("Admin".into());
app.coding_data_retention_opt_out = false; // currently opted-in
let effects = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
assert_eq!(effects.len(), 1);
match &effects[0] {
Effect::SetCodingDataSharing {
opted_in,
rollback_to_opted_in,
..
} => {
assert!(!*opted_in, "Effect must carry opted_in=false");
assert!(
*rollback_to_opted_in,
"rollback_to_opted_in must capture pre-toggle opt-in=true",
);
}
other => panic!("expected SetCodingDataSharing Effect, got {other:?}"),
}
// Optimistic mutation already applied.
assert!(
app.coding_data_retention_opt_out,
"admin-allowed dispatch must optimistically flip state",
);
}
/// Non-idempotent dispatch emits one Effect AND mutates state
/// optimistically AND toasts.
#[test]
fn set_coding_data_sharing_produces_effect_and_optimistic_mutation() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = false; // currently opted-in
let effects = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
assert_eq!(effects.len(), 1, "non-idempotent dispatch emits one Effect");
match &effects[0] {
Effect::SetCodingDataSharing {
agent_id,
opted_in,
rollback_to_opted_in,
} => {
assert_eq!(*agent_id, AgentId(0));
assert!(!*opted_in);
assert!(
*rollback_to_opted_in,
"rollback_to_opted_in must be pre-toggle value (true == opted-in)",
);
}
other => panic!("expected SetCodingDataSharing Effect, got {other:?}"),
}
// Optimistic mutation applied.
assert!(
app.coding_data_retention_opt_out,
"dispatch must optimistically mutate state",
);
// Toast on every dispatch (SHELL setter contract).
assert!(app.agents[&AgentId(0)].toast.is_some());
}
/// `TaskResult::CodingDataSharingUpdated` re-anchors state to the
/// server-confirmed value (defense-in-depth) and re-toasts.
#[test]
fn coding_data_sharing_updated_re_anchors_state_and_re_toasts() {
let mut app = test_app_with_agent();
// Simulate post-optimistic state: opted-out.
app.coding_data_retention_opt_out = true;
let id = AgentId(0);
// Server confirms opt-out (same as optimistic).
let effects = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingUpdated {
agent_id: id,
opted_in: false,
}),
&mut app,
);
assert!(effects.is_empty(), "TaskResult arm must NOT emit Effect");
// State re-anchored (was already true, stays true).
assert!(app.coding_data_retention_opt_out);
// Re-toast on confirmation uses display name + ✓.
let toast = read_toast(&app);
assert!(
toast.contains("Opt out"),
"confirmation toast must use display name 'Opt out': {toast}",
);
assert!(
toast.contains('\u{2713}'),
"opt-out confirmation toast uses ✓: {toast}",
);
}
/// `TaskResult::CodingDataSharingUpdated` corrects the in-memory
/// state if the server reshapes the boolean (e.g. policy
/// override). Pins the defense-in-depth re-anchor contract.
#[test]
fn coding_data_sharing_updated_corrects_state_if_server_disagrees() {
let mut app = test_app_with_agent();
// Optimistic mutation said "opt-out" — but the server
// overrides to "opt-in" (e.g. policy that prevents opt-out).
app.coding_data_retention_opt_out = true;
let id = AgentId(0);
let effects = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingUpdated {
agent_id: id,
opted_in: true, // server says opted-in
}),
&mut app,
);
assert!(effects.is_empty());
// State corrected to match server.
assert!(
!app.coding_data_retention_opt_out,
"server-confirmed opt-in must overwrite optimistic opt-out",
);
// Server-correction toast uses the destructive ⚠
// pattern for the opt-in direction (the privacy-degrading
// override deserves the warning glyph even if the SERVER, not
// the user, made the call).
let toast = read_toast(&app);
assert!(
toast.contains("Opt in"),
"post-correction toast uses display name 'Opt in': {toast}",
);
assert!(
toast.contains('\u{26A0}'),
"opt-in direction always uses ⚠ glyph, even on server-correction path: {toast}",
);
}
/// `TaskResult::CodingDataSharingFailed` REVERTS the optimistic
/// mutation and surfaces a failure toast. Pins the rollback
/// contract.
///
/// Failure toast uses the standardised "coding data sharing"
/// wording.
#[test]
fn coding_data_sharing_failed_rolls_back_and_toasts_error() {
let mut app = test_app_with_agent();
// Simulate post-optimistic state: user picked opt-out, state
// was flipped, then the ACP call failed. The pre-toggle value
// was opt-in (true), so `rollback_to_opted_in = true`.
app.coding_data_retention_opt_out = true;
let id = AgentId(0);
let effects = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingFailed {
agent_id: id,
error: "server error".into(),
rollback_to_opted_in: true,
}),
&mut app,
);
assert!(effects.is_empty(), "rollback path must NOT emit Effect");
// State reverted to pre-toggle (opted-in).
assert!(
!app.coding_data_retention_opt_out,
"rollback must revert optimistic mutation",
);
// Failure toast surfaces the error using full label.
let toast = read_toast(&app);
assert!(
toast.contains("coding data sharing"),
"PR 9 R1: failure toast wording standardised to include 'coding data sharing' \
(G2 Issue 2): {toast}",
);
assert!(toast.contains("server error"), "error in toast: {toast}");
assert!(toast.contains('\u{2717}'), "failure toast uses ✗: {toast}");
}
/// `TaskResult::CodingDataSharingFailed` reverts in the OTHER
/// direction too (the pre-toggle state could have been either).
#[test]
fn coding_data_sharing_failed_rolls_back_to_opt_out() {
let mut app = test_app_with_agent();
// Post-optimistic: opted-in (user picked opt-in, server
// failed, pre-toggle was opt-out).
app.coding_data_retention_opt_out = false;
let id = AgentId(0);
let effects = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingFailed {
agent_id: id,
error: "network timeout".into(),
rollback_to_opted_in: false,
}),
&mut app,
);
assert!(effects.is_empty());
// Reverted to pre-toggle opt-out.
assert!(
app.coding_data_retention_opt_out,
"rollback to opt-out must set state=true",
);
}
/// Optimistic mutation refreshes any open settings modal.
/// Without this refresh, the modal indicator would stay at the
/// pre-toggle value until manual re-render.
#[test]
fn set_coding_data_sharing_refreshes_open_modal_snapshot() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = false;
// Open a settings modal (capture initial snapshot).
let _ = dispatch(Action::OpenSettings, &mut app);
// Verify snapshot reads opted-in.
let agent_id = AgentId(0);
{
let state = match &app.agents[&agent_id].active_modal {
Some(crate::views::modal::ActiveModal::Settings { state }) => state,
_ => panic!("expected Settings modal open after OpenSettings dispatch"),
};
assert!(
!state.pager_snapshot.coding_data_sharing_opt_out,
"initial snapshot must read opt_out=false (opted-in)",
);
}
// Dispatch the toggle.
let _ = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
// Snapshot now reflects the optimistic mutation.
let state = match &app.agents[&agent_id].active_modal {
Some(crate::views::modal::ActiveModal::Settings { state }) => state,
_ => panic!("Settings modal must still be open after SetCodingDataSharing dispatch"),
};
assert!(
state.pager_snapshot.coding_data_sharing_opt_out,
"snapshot must refresh to reflect opt_out=true (opted-out) after dispatch",
);
}
/// Rollback also refreshes the modal — the user sees the
/// reverted value, not the stale optimistic one.
#[test]
fn coding_data_sharing_failed_refreshes_open_modal_snapshot() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = false;
let _ = dispatch(Action::OpenSettings, &mut app);
// Optimistic flip.
let _ = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
// ACP failure.
let _ = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingFailed {
agent_id: AgentId(0),
error: "x".into(),
rollback_to_opted_in: true,
}),
&mut app,
);
let state = match &app.agents[&AgentId(0)].active_modal {
Some(crate::views::modal::ActiveModal::Settings { state }) => state,
_ => panic!("Settings modal must still be open after rollback TaskResult"),
};
assert!(
!state.pager_snapshot.coding_data_sharing_opt_out,
"rollback must refresh snapshot back to opt_out=false (opted-in)",
);
}
// ── coding_data_sharing toast tests ─────────────
/// The opt-in transition
/// uses the **`⚠` destructive-warning glyph** + spelled-out
/// consequence text — mirroring `yolo_toast`'s
/// "Always-approve ON: all tool actions auto-run" pattern. The
/// consequence text is verbatim-pinned because the toast is the
/// only post-commit feedback for a privacy-degrading transition;
/// a future PR that softens the wording silently degrades the
/// safety affordance.
#[test]
fn set_coding_data_sharing_opt_in_renders_destructive_warning_toast() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = true; // currently opted-out
let effects = dispatch(Action::SetCodingDataSharing { opted_in: true }, &mut app);
assert_eq!(effects.len(), 1, "non-idempotent opt-in must emit Effect");
let toast = read_toast(&app);
assert!(
toast.contains('\u{26A0}'),
"opt-in toast MUST use ⚠ glyph (PR 9 R1, General-3 Issue 5 — \
privacy-degrading transition deserves destructive-warning glyph): {toast}",
);
assert!(
!toast.contains('\u{2713}'),
"opt-in toast MUST NOT use the uniform ✓ glyph — that's the \
safe-default toast for opt-out: {toast}",
);
assert!(
toast.contains("Opt in"),
"destructive toast still uses display name 'Opt in': {toast}",
);
// Consequence text pinned: a future PR softening this loses
// the safety affordance.
assert!(
toast.contains("code samples"),
"destructive toast must spell out the consequence \
(mention 'code samples'): {toast}",
);
assert!(
toast.contains("training"),
"destructive toast must spell out the consequence \
(mention 'training'): {toast}",
);
}
/// The opt-out transition uses the
/// uniform `✓` glyph (safe default), NOT the destructive `⚠`.
/// Mirrors `yolo_toast(false)` precedent — restoring the safe
/// default doesn't warrant the heavier visual.
#[test]
fn set_coding_data_sharing_opt_out_renders_safe_default_toast() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = false; // currently opted-in
let _ = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
let toast = read_toast(&app);
assert!(
toast.contains('\u{2713}'),
"opt-out toast uses ✓ safe-default glyph: {toast}",
);
assert!(
!toast.contains('\u{26A0}'),
"opt-out toast MUST NOT use ⚠ — that's reserved for the privacy-degrading \
direction (PR 9 R1): {toast}",
);
assert!(toast.contains("Opt out"));
}
/// The toast renders
/// the registered `EnumChoice.display` ("Opt in" / "Opt out"),
/// NOT the persisted canonical ("opt-in" / "opt-out"). Mirrors
/// the `set_theme_toast_format_uses_display_name` contract.
/// The display strings here are pinned by the
/// `coding_data_sharing_choices_use_canonical_strings` e2e test
/// (registry side) AND
/// `pr9_coding_data_sharing_choices_use_canonical_strings` (which
/// also pins the display labels via the same EnumChoice
/// entries).
#[test]
fn coding_data_sharing_toast_format_uses_display_name() {
let mut app = test_app_with_agent();
// Opt-in direction.
app.coding_data_retention_opt_out = true;
let _ = dispatch(Action::SetCodingDataSharing { opted_in: true }, &mut app);
let opt_in_toast = read_toast(&app);
assert!(
opt_in_toast.contains("Opt in"),
"opt-in toast uses display 'Opt in', not canonical 'opt-in': {opt_in_toast}",
);
// Clear and test opt-out direction.
app.agents.get_mut(&AgentId(0)).unwrap().toast = None;
app.coding_data_retention_opt_out = false;
let _ = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
let opt_out_toast = read_toast(&app);
assert!(
opt_out_toast.contains("Opt out"),
"opt-out toast uses display 'Opt out', not canonical 'opt-out': {opt_out_toast}",
);
}
/// The failure toast
/// substitutes a generic placeholder when the error string is
/// too long OR contains control characters / newlines. Pins the
/// scrub contract.
#[test]
fn coding_data_sharing_failed_scrubs_long_error_messages() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = true;
let id = AgentId(0);
// ~500-char error simulating a stack trace / HTML 502 page.
let huge_error = "a".repeat(500);
let _ = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingFailed {
agent_id: id,
error: huge_error.clone(),
rollback_to_opted_in: false,
}),
&mut app,
);
let toast = read_toast(&app);
assert!(
!toast.contains(&huge_error),
"long error MUST be scrubbed from the toast: {} chars",
toast.len(),
);
assert!(
toast.contains("see logs"),
"scrubbed toast must point at the log for full details: {toast}",
);
}
/// Control characters (CR/LF/NUL)
/// in the error trigger the scrub path even on short strings —
/// preserves the toast's single-line layout.
#[test]
fn coding_data_sharing_failed_scrubs_control_chars_in_error() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = true;
let id = AgentId(0);
// Short message with embedded newlines.
let multiline = "line1\nline2\nline3".to_string();
let _ = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingFailed {
agent_id: id,
error: multiline.clone(),
rollback_to_opted_in: false,
}),
&mut app,
);
let toast = read_toast(&app);
assert!(
!toast.contains('\n'),
"newlines MUST be scrubbed from the toast (would break single-line layout): \
{toast:?}",
);
assert!(
toast.contains("see logs"),
"control-char-scrubbed toast points at logs: {toast}",
);
}
/// The scrub path preserves short,
/// sanitised error messages verbatim — the typical happy-path
/// shell-side error string stays unscrubbed.
#[test]
fn coding_data_sharing_failed_preserves_short_clean_error_message() {
let mut app = test_app_with_agent();
app.coding_data_retention_opt_out = true;
let id = AgentId(0);
let short_clean = "network timeout".to_string();
let _ = dispatch(
Action::TaskComplete(TaskResult::CodingDataSharingFailed {
agent_id: id,
error: short_clean.clone(),
rollback_to_opted_in: false,
}),
&mut app,
);
let toast = read_toast(&app);
assert!(
toast.contains(&short_clean),
"short clean error must appear verbatim in the toast: {toast}",
);
assert!(
!toast.contains("see logs"),
"short clean error must NOT trigger the scrub fallback: {toast}",
);
}
/// Direct unit test of the `scrub_error_for_toast` helper —
/// pins the threshold and the fallback string against drift.
#[test]
@@ -766,31 +113,6 @@ fn scrub_error_for_toast_unit() {
);
}
/// The no-agent path
/// returns empty cleanly — no toast (the show_toast call would
/// no-op anyway), no panic, no Effect emitted. A "✗ No active
/// session" toast would be dead UX (no agent = no toast surface
/// to render on), so this path emits a tracing::warn! instead.
#[test]
fn set_coding_data_sharing_no_agents_returns_empty_without_panic() {
let mut app = test_app_with_agent();
// Remove every agent so the dispatcher hits the no-agent path.
app.agents.clear();
// Force the view off Agent so the dispatcher falls through to
// app.agents.keys().next() which is now empty.
app.active_view = ActiveView::Welcome;
let effects = dispatch(Action::SetCodingDataSharing { opted_in: false }, &mut app);
assert!(
effects.is_empty(),
"no-agent path must return empty (no Effect to fire)",
);
// State unchanged (we never reach the optimistic mutation).
assert!(
!app.coding_data_retention_opt_out,
"no-agent path must NOT mutate state",
);
}
#[test]
fn dispatch_rename_session_updates_display_name_locally() {
let mut app = test_app_with_agent();
@@ -898,27 +220,6 @@ fn show_usage_on_welcome_screen_is_noop() {
);
}
#[test]
fn show_usage_with_redirect_url_shows_link_and_skips_fetch() {
let mut app = test_app_with_agent();
app.usage_billing_redirect_url = Some("https://billing.example.com/me".to_string());
let before = agent_scrollback_len(&app);
let effects = dispatch(Action::ShowUsage, &mut app);
assert!(
effects.is_empty(),
"with a redirect URL set, ShowUsage should not fetch (billing or auto-topup), got: {effects:?}"
);
assert_eq!(
agent_scrollback_len(&app),
before + 1,
"redirect path should push one system message with the billing link"
);
assert!(
last_system_text(&app, AgentId(0)).contains("https://billing.example.com/me"),
"redirect message should use the remote settings-provided URL"
);
}
// ── Minimal update-notice tests ──────────────────────────────────────
#[test]
crates/codegen/kigi-tui/src/app/dispatch/tests/task_result.rs
+3 -502
View File
@@ -1494,391 +1494,6 @@ fn rename_session_failed_keeps_local_display_name_and_pushes_system_block() {
);
}
// ── GateRefreshed subscription flow ─────────────────────────────
/// Regression: when the 30s gate poll detects the subscription gate has
/// been lifted, it must emit `CheckSubscription` so the shell refreshes
/// the JWT. Without this the auth token still lacks the subscription
/// claim and all API calls return 403.
#[test]
fn gate_refreshed_emits_check_subscription_on_gate_lift() {
let mut app = test_app();
// User starts gated (no subscription).
app.gate = Some(kigi_shell::auth::GateInfo {
message: "SuperGrok subscription required".into(),
url: Some("https://grok.com/supergrok".into()),
label: Some("Subscribe".into()),
});
assert!(!app.has_access());
// Server-side settings now show no gate (user purchased subscription).
let settings = kigi_shell::util::config::RemoteSettings::default();
let effects = dispatch_task_result(
TaskResult::GateRefreshed {
settings: Some(settings),
},
&mut app,
);
// Gate must be lifted.
assert!(app.has_access(), "gate should be lifted");
assert!(app.welcome_prompt_focused, "prompt should be focused");
// Must emit CheckSubscription to trigger shell-side JWT refresh.
assert!(
effects
.iter()
.any(|e| matches!(e, Effect::CheckSubscription { verify: None })),
"must emit CheckSubscription to refresh JWT; got: {effects:?}"
);
}
/// When the gate poll returns settings that still have a gate, no
/// effects should be emitted and the user stays blocked.
#[test]
fn gate_refreshed_no_effect_when_still_gated() {
let mut app = test_app();
app.gate = Some(kigi_shell::auth::GateInfo {
message: "Subscribe".into(),
url: None,
label: None,
});
let settings = kigi_shell::util::config::RemoteSettings {
gate_message: Some("Subscribe".into()),
..Default::default()
};
let effects = dispatch_task_result(
TaskResult::GateRefreshed {
settings: Some(settings),
},
&mut app,
);
assert!(!app.has_access(), "gate should remain");
assert!(effects.is_empty(), "no effects when still gated");
}
/// When the user was never gated, GateRefreshed is a no-op.
#[test]
fn gate_refreshed_no_effect_when_already_unblocked() {
let mut app = test_app();
assert!(app.has_access()); // no gate
let settings = kigi_shell::util::config::RemoteSettings::default();
let effects = dispatch_task_result(
TaskResult::GateRefreshed {
settings: Some(settings),
},
&mut app,
);
assert!(effects.is_empty(), "no effects when already unblocked");
}
/// A gate newly imposed by the 30s settings poll (possibly stale) must be
/// deferred for live verification instead of painting the paywall directly:
/// the gate is held out of `app.gate` and a `CheckSubscription` +
/// verify-timeout pair is emitted.
#[test]
fn gate_refreshed_newly_blocked_defers_gate_for_verification() {
let mut app = test_app();
assert!(app.has_access()); // ungated
let settings = kigi_shell::util::config::RemoteSettings {
gate_message: Some("Subscribe".into()),
..Default::default()
};
let effects = dispatch_task_result(
TaskResult::GateRefreshed {
settings: Some(settings),
},
&mut app,
);
assert!(
app.has_access(),
"deferred gate must not show as paywall before verification"
);
assert!(app.pending_gate_verification.is_some());
assert!(
effects
.iter()
.any(|e| matches!(e, Effect::CheckSubscription { verify: Some(_) })),
"must live-check before showing the paywall; got: {effects:?}"
);
assert!(
effects
.iter()
.any(|e| matches!(e, Effect::ScheduleGateVerifyTimeout { .. })),
"must arm the verification timeout; got: {effects:?}"
);
}
// ── Stale-gate verification resolution ──────────────────────────
fn test_gate() -> kigi_shell::auth::GateInfo {
kigi_shell::auth::GateInfo {
message: "Subscribe".into(),
url: None,
label: None,
}
}
/// The live check confirmed access (meta without a gate): the deferred
/// stale gate is dropped and the paywall never shows.
#[test]
fn verify_check_with_meta_resolves_pending_gate() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
assert!(app.has_access());
let meta = serde_json::to_value(kigi_shell::auth::AuthMeta::default()).unwrap();
dispatch_task_result(
TaskResult::CheckSubscriptionComplete {
verify: Some(app.gate_verify_gen),
meta: Some(meta),
},
&mut app,
);
assert!(app.has_access(), "live check says subscribed — no paywall");
assert!(app.pending_gate_verification.is_none());
}
/// The verification's own check failed (meta None) while its stale gate
/// was deferred: err on blocking — the deferred gate is promoted.
#[test]
fn verify_check_failure_promotes_pending_gate() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
let effects = dispatch_task_result(
TaskResult::CheckSubscriptionComplete {
verify: Some(app.gate_verify_gen),
meta: None,
},
&mut app,
);
assert!(!app.has_access(), "check failed — deferred gate must show");
assert!(app.pending_gate_verification.is_none());
assert!(
effects
.iter()
.any(|e| matches!(e, Effect::SchedulePaywallCheck)),
"freshly shown gate must arm the 5s auto-lift chain; got: {effects:?}"
);
}
/// A failed GENERIC check (watch / focus / paywall chain — no generation)
/// must never promote a deferred gate: only the deferral's own
/// generation-scoped check or timeout may (a superseded or unrelated check
/// failing is not evidence about the current verification).
#[test]
fn check_subscription_complete_failure_leaves_pending_gate_untouched() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
let effects = dispatch_task_result(
TaskResult::CheckSubscriptionComplete {
verify: None,
meta: None,
},
&mut app,
);
assert!(effects.is_empty());
assert!(
app.has_access(),
"generic check failure must not promote the deferred gate"
);
assert!(
app.pending_gate_verification.is_some(),
"verification must stay in flight"
);
}
/// A failed verification check from a SUPERSEDED deferral (older
/// generation) must not promote the newer pending gate.
#[test]
fn verify_check_stale_generation_failure_is_ignored() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
let stale_gen = app.gate_verify_gen;
// Second deferral supersedes the first (its check is in flight).
let _effs = app.impose_gate(test_gate());
let effects = dispatch_task_result(
TaskResult::CheckSubscriptionComplete {
verify: Some(stale_gen),
meta: None,
},
&mut app,
);
assert!(effects.is_empty());
assert!(
app.has_access(),
"superseded verification failure must not promote the newer gate"
);
assert!(app.pending_gate_verification.is_some());
}
/// A check failure with no deferred gate (the plain paywall-poller path)
/// must not invent a gate.
#[test]
fn check_subscription_complete_failure_without_pending_gate_is_noop() {
let mut app = test_app();
dispatch_task_result(
TaskResult::CheckSubscriptionComplete {
verify: None,
meta: None,
},
&mut app,
);
assert!(app.has_access());
}
/// The verification window expired before the live check resolved:
/// err on blocking — the deferred gate is promoted, and the freshly shown
/// paywall gets the 5s auto-lift chain.
#[test]
fn gate_verify_timeout_promotes_pending_gate() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
assert!(app.has_access());
let effects = dispatch_task_result(
TaskResult::GateVerifyTimeout {
generation: app.gate_verify_gen,
},
&mut app,
);
assert!(!app.has_access(), "timeout — deferred gate must show");
assert!(app.pending_gate_verification.is_none());
assert!(
app.paywall_check_started.is_some(),
"promoted gate must arm the paywall auto-check chain"
);
assert!(
effects
.iter()
.any(|e| matches!(e, Effect::SchedulePaywallCheck)),
"promoted gate must schedule the 5s chain; got: {effects:?}"
);
}
/// The timeout fires after the check already resolved the gate: no-op.
#[test]
fn gate_verify_timeout_noop_when_already_resolved() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
let generation = app.gate_verify_gen;
// Live check resolved first (access confirmed).
let meta = serde_json::to_value(kigi_shell::auth::AuthMeta::default()).unwrap();
dispatch_task_result(
TaskResult::CheckSubscriptionComplete {
verify: None,
meta: Some(meta),
},
&mut app,
);
dispatch_task_result(TaskResult::GateVerifyTimeout { generation }, &mut app);
assert!(
app.has_access(),
"stale timeout must not re-impose the gate"
);
}
/// A timeout from a SUPERSEDED verification (older generation) must not
/// promote a newer deferred gate whose own live check is still in flight.
#[test]
fn gate_verify_timeout_stale_generation_is_ignored() {
let mut app = test_app();
// First deferral resolves (access confirmed) ...
let _effs = app.impose_gate(test_gate());
let stale_gen = app.gate_verify_gen;
let meta = serde_json::to_value(kigi_shell::auth::AuthMeta::default()).unwrap();
dispatch_task_result(
TaskResult::CheckSubscriptionComplete {
verify: None,
meta: Some(meta),
},
&mut app,
);
// ... then a SECOND gate is deferred (check in flight).
let _effs = app.impose_gate(test_gate());
assert!(app.has_access());
// The FIRST deferral's timer fires now — it must not promote the
// second deferral's pending gate.
let effects = dispatch_task_result(
TaskResult::GateVerifyTimeout {
generation: stale_gen,
},
&mut app,
);
assert!(effects.is_empty());
assert!(
app.has_access(),
"stale-generation timer must not promote the newer pending gate"
);
assert!(
app.pending_gate_verification.is_some(),
"the newer verification must stay in flight"
);
}
/// `GateRefreshed` with gate-free settings while a deferred gate awaits
/// verification must drop the pending copy — the fresh settings are newer
/// than the stale snapshot that produced it — and still run the lift
/// bookkeeping (`CheckSubscription` for the JWT refresh), since the pending
/// deferral means the user was conceptually blocked.
#[test]
fn gate_refreshed_without_gate_clears_pending_verification() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
let generation = app.gate_verify_gen;
let settings = kigi_shell::util::config::RemoteSettings::default();
let effects = dispatch_task_result(
TaskResult::GateRefreshed {
settings: Some(settings),
},
&mut app,
);
assert!(app.pending_gate_verification.is_none());
assert!(
effects
.iter()
.any(|e| matches!(e, Effect::CheckSubscription { verify: None })),
"settings-confirmed lift of a pending gate must refresh the JWT; got: {effects:?}"
);
// The still-armed timer must find nothing to promote.
dispatch_task_result(TaskResult::GateVerifyTimeout { generation }, &mut app);
assert!(
app.has_access(),
"cleared pending gate must not resurface via the timer"
);
}
/// Logout clears any deferred gate and the check debounce.
#[test]
fn logout_clears_pending_gate_verification() {
let mut app = test_app();
let _effs = app.impose_gate(test_gate());
dispatch_task_result(TaskResult::LogoutComplete, &mut app);
assert!(app.pending_gate_verification.is_none());
assert!(app.last_subscription_check_at.is_none());
}
/// `apply_setting_rollback` on a known key reverts the in-memory
/// cache without emitting any new effects.
#[test]
@@ -2002,38 +1617,16 @@ fn rollback_to_always_approve_blocked_by_policy_pin() {
assert!(!app.default_yolo);
}
// -- Degraded conversations lane (SessionListLoaded.partial) ----------
// -- SessionListLoaded ------------------------------------------------
/// A degraded conversations lane surfaces an actionable notice instead of
/// the misleading "No sessions found" toast.
/// Canary: an empty list surfaces the generic "no sessions" toast.
#[test]
fn session_list_partial_no_oauth_surfaces_login_hint() {
fn session_list_empty_shows_generic_toast() {
let mut app = test_app_with_agent();
open_session_picker_with(&mut app, vec![]);
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![],
partial: Some(crate::app::effects::ConversationsPartial::NoOauth),
seq: 0,
query: None,
}),
&mut app,
);
assert!(
read_toast(&app).contains("/login"),
"no_oauth must point at /login"
);
}
/// Canary: an empty list without a degraded lane keeps the generic toast.
#[test]
fn session_list_empty_without_partial_keeps_generic_toast() {
let mut app = test_app_with_agent();
open_session_picker_with(&mut app, vec![]);
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![],
partial: None,
seq: 0,
query: None,
}),
@@ -2041,95 +1634,3 @@ fn session_list_empty_without_partial_keeps_generic_toast() {
);
assert!(read_toast(&app).contains("No sessions found"));
}
/// Non-empty degraded list under chat mode (welcome-fallback branch):
/// entries land AND the retry notice surfaces; Build mode stays silent.
#[test]
fn session_list_nonempty_partial_toasts_retry_in_chat_mode_only() {
let mut app = test_app_with_agent();
app.chat_mode = true;
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-part-1")],
partial: Some(crate::app::effects::ConversationsPartial::Timeout),
seq: 0,
query: None,
}),
&mut app,
);
assert!(
app.session_picker_entries.is_some(),
"entries must still land on a degraded lane"
);
assert!(
read_toast(&app).contains("retry"),
"timeout must surface the retry notice"
);
// Build-mode canary: stays silent on a degraded lane.
let mut app = test_app_with_agent();
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_picker_entry("local-part-1", "/r")],
partial: Some(crate::app::effects::ConversationsPartial::Timeout),
seq: 0,
query: None,
}),
&mut app,
);
assert!(
app.agents[&AgentId(0)].toast.is_none(),
"Build-mode non-empty degraded list stays silent"
);
}
/// Modal variant of the non-empty degraded-lane notice: same chat-mode-only
/// gating as the welcome-fallback branch.
#[test]
fn session_list_nonempty_partial_modal_toasts_in_chat_mode_only() {
use crate::views::modal::ActiveModal;
let mut app = test_app_with_agent();
app.chat_mode = true;
open_session_picker_with(&mut app, vec![]);
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_conversation_entry("conv-part-m1")],
partial: Some(crate::app::effects::ConversationsPartial::Timeout),
seq: 0,
query: None,
}),
&mut app,
);
let agent = get_active_agent(&app).expect("active agent");
assert!(
matches!(
agent.active_modal.as_ref(),
Some(ActiveModal::SessionPicker {
entries: Some(list),
..
}) if list.len() == 1
),
"entries must land in the open modal on a degraded lane"
);
assert!(
read_toast(&app).contains("retry"),
"chat-mode modal must surface the retry notice"
);
// Build-mode canary: the open modal stays silent.
let mut app = test_app_with_agent();
open_session_picker_with(&mut app, vec![]);
let _ = dispatch(
Action::TaskComplete(TaskResult::SessionListLoaded {
sessions: vec![make_picker_entry("local-part-m1", "/r")],
partial: Some(crate::app::effects::ConversationsPartial::Timeout),
seq: 0,
query: None,
}),
&mut app,
);
assert!(
app.agents[&AgentId(0)].toast.is_none(),
"Build-mode modal non-empty degraded list stays silent"
);
}
crates/codegen/kigi-tui/src/app/dispatch/transcript.rs
+1 -2
View File
@@ -372,8 +372,7 @@ pub(super) fn dispatch_open_extensions_modal(
// Mutual exclusivity: close agents modal when opening extensions.
agent.agents_modal = None;
let mut modal = ExtensionsModalState::new(tab);
modal.session_team_id = app.team_id.clone();
let modal = ExtensionsModalState::new(tab);
agent.extensions_modal = Some(modal);
let Some(session_id) = agent.session.session_id.clone() else {
crates/codegen/kigi-tui/src/app/effects/helpers.rs
+9 -225
View File
@@ -43,9 +43,6 @@ pub(super) const SESSION_SEARCH_DEBOUNCE_MS: u64 = 250;
/// All other errors are sanitized to remove internal service names and jargon.
pub(super) fn format_acp_error(err: &acp::Error, is_api_key_auth: bool) -> String {
if i32::from(err.code) == RATE_LIMITED_ERROR_CODE {
if super::dispatch::acp_error_is_free_usage_exhausted(err) {
return super::dispatch::FREE_USAGE_USER_MESSAGE.into();
}
return rate_limited_user_message(is_api_key_auth).into();
}
if err.code == acp::ErrorCode::InvalidParams && let Some(data) = &err.data
@@ -132,8 +129,6 @@ pub(crate) fn sanitize_user_error(raw: &str) -> String {
return "Out of disk space.".to_string();
}
static REPLACEMENTS: &[(&str, &str)] = &[
("cli-chat-proxy", "server"),
("cli_chat_proxy", "server"),
("inference-api", "server"),
("inference_api", "server"),
("research-api", "server"),
@@ -365,41 +360,6 @@ pub(super) fn count_chat_history_stats(history_path: &Path) -> (usize, usize) {
}
(turn_count, tool_call_count)
}
/// Degraded conversations lane on `x.ai/session/list`, parsed from the
/// response's `_meta["x.ai/partial"]` envelope.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ConversationsPartial {
NoOauth,
Timeout,
Error,
}
impl ConversationsPartial {
/// Actionable picker notice for a degraded conversations lane.
pub(crate) fn picker_notice(self) -> &'static str {
match self {
Self::NoOauth => "Couldn't load your chats \u{2014} log in with /login",
Self::Timeout | Self::Error => "Couldn't load conversations \u{2014} retry",
}
}
}
/// Read `_meta["x.ai/partial"]` from a session-list payload. `None` when the
/// conversations lane completed (or was skipped); unknown reasons degrade to
/// [`ConversationsPartial::Error`].
pub(super) fn parse_session_list_partial(
payload: &serde_json::Value,
) -> Option<ConversationsPartial> {
let partial = payload.get("_meta")?.get("x.ai/partial")?;
if partial.get("conversations").and_then(|v| v.as_bool()) != Some(true) {
return None;
}
Some(
match partial.get("reason").and_then(|v| v.as_str()) {
Some("no_oauth") => ConversationsPartial::NoOauth,
Some("timeout") => ConversationsPartial::Timeout,
_ => ConversationsPartial::Error,
},
)
}
/// Parse the `x.ai/session/list` response payload (the unwrapped
/// `{ "sessions": [...] }` object) into [`SessionPickerEntry`] rows.
///
@@ -597,73 +557,6 @@ pub(super) async fn send_logout(tx: &AcpAgentTx) {
tracing::warn!(error = % e, "logout failed");
}
}
pub(super) async fn send_check_subscription(
tx: &AcpAgentTx,
verify: Option<u64>,
) -> TaskResult {
let req = acp::ExtRequest::new(
"x.ai/auth/check_subscription",
serde_json::value::to_raw_value(&serde_json::json!({}))
.expect("serialize check_subscription params")
.into(),
);
match acp_send(req, tx).await {
Ok(resp) => {
let meta = serde_json::from_str::<serde_json::Value>(resp.0.get())
.ok()
.and_then(|v| v.get("meta").cloned());
TaskResult::CheckSubscriptionComplete {
verify,
meta,
}
}
Err(e) => {
tracing::warn!(error = % e, "check_subscription failed");
crate::unified_log::warn(
"subscription.check.rpc_failed",
None,
Some(serde_json::json!({ "verify" : verify, "error" : e.to_string(), })),
);
TaskResult::CheckSubscriptionComplete {
verify,
meta: None,
}
}
}
}
/// One-shot subscription re-check for the credit-limit retry flow.
/// Same ACP call as `send_check_subscription` but returns a
/// `CreditLimitRecheckComplete` so the dispatch layer can decide
/// whether to retry the stashed prompt or show the upsell.
pub(super) async fn send_credit_limit_recheck(
tx: &AcpAgentTx,
agent_id: AgentId,
) -> TaskResult {
let req = acp::ExtRequest::new(
"x.ai/auth/check_subscription",
serde_json::value::to_raw_value(&serde_json::json!({}))
.expect("serialize check_subscription params")
.into(),
);
match acp_send(req, tx).await {
Ok(resp) => {
let meta = serde_json::from_str::<serde_json::Value>(resp.0.get())
.ok()
.and_then(|v| v.get("meta").cloned());
TaskResult::CreditLimitRecheckComplete {
agent_id,
meta,
}
}
Err(e) => {
tracing::warn!(error = % e, "credit_limit_recheck failed");
TaskResult::CreditLimitRecheckComplete {
agent_id,
meta: None,
}
}
}
}
pub(super) async fn send_authenticate(
tx: &AcpAgentTx,
request_seq: u64,
@@ -1199,125 +1092,16 @@ pub(super) fn persist_hint(
TaskResult::CancelComplete
});
}
/// Map a billing config into a [`CreditBalance`].
///
/// Prefers the newer credits-config fields (`credit_usage_percent`,
/// `current_period`) and falls back to the deprecated
/// `monthly_limit`/`used`/`billing_period_end`. Shared by `Effect::FetchBilling`
/// and `Effect::FetchAppBilling` so every pager UI path derives identical usage
/// values from the same config.
pub(super) fn credit_balance_from_config(
c: kigi_shell::extensions::billing::BillingConfig,
) -> crate::views::credit_bar::CreditBalance {
let limit = c.monthly_limit.map(|v| v.val).unwrap_or(0);
let used = c.used.map(|v| v.val).unwrap_or(0);
let has_credit_pct = c.credit_usage_percent.is_some();
let usage_pct = match c.credit_usage_percent {
Some(pct) => pct.clamp(0.0, 100.0),
None if limit > 0 => (used as f64 / limit as f64 * 100.0).min(100.0),
None => 0.0,
};
let period_end_display = c
.current_period
.as_ref()
.and_then(|p| p.end.clone())
.or(c.billing_period_end)
.and_then(|s| {
chrono::DateTime::parse_from_rfc3339(&s)
.ok()
.map(|dt| {
dt.with_timezone(&chrono::Local).format("%B %-d, %H:%M").to_string()
})
});
let on_demand_val = c.on_demand_cap.map(|v| v.val).unwrap_or(0);
let pay_as_you_go = on_demand_val > 0;
let on_demand_cap_cents = if on_demand_val > 0 { Some(on_demand_val) } else { None };
let on_demand_used_cents = c
.on_demand_used
.map(|v| v.val)
.unwrap_or_else(|| (used - limit).max(0));
let effective_usage_pct = if on_demand_val > 0 {
if usage_pct >= 100.0 {
(on_demand_used_cents as f64 / on_demand_val as f64 * 100.0).min(100.0)
} else if has_credit_pct {
usage_pct
} else {
let total_budget = limit + on_demand_val;
if total_budget > 0 {
(used as f64 / total_budget as f64 * 100.0).min(100.0)
} else {
0.0
}
}
} else {
usage_pct
};
let period_type = c.current_period.as_ref().and_then(|p| p.period_type.clone());
crate::views::credit_bar::CreditBalance {
usage_pct,
effective_usage_pct,
period_end_display,
pay_as_you_go,
on_demand_cap_cents,
on_demand_used_cents: Some(on_demand_used_cents),
prepaid_balance_cents: c.prepaid_balance.map(|v| v.val),
period_type,
is_unified_billing_user: c.is_unified_billing_user,
}
}
/// Whether the balance carries a non-zero prepaid credit balance (signed cents).
pub(super) fn has_prepaid_credits(
balance: Option<&crate::views::credit_bar::CreditBalance>,
) -> bool {
balance.and_then(|b| b.prepaid_balance_cents).map(i64::abs).is_some_and(|c| c > 0)
}
/// Fetch the user's auto top-up rule via the `x.ai/auto-topup-rule` extension.
/// A transport failure yields [`AutoTopupFetch::Unchanged`] so the caller keeps
/// any cached rule rather than treating the blip as "no auto top-up".
pub(super) async fn fetch_auto_topup_info(
tx: &kigi_acp_lib::AcpAgentTx,
) -> crate::views::credit_bar::AutoTopupFetch {
use crate::views::credit_bar::AutoTopupFetch;
let req = acp::ExtRequest::new(
"x.ai/auto-topup-rule",
serde_json::value::to_raw_value(&serde_json::json!({}))
.expect("serialize auto-topup params")
.into(),
);
let Ok(resp) = acp_send(req, tx).await else {
return AutoTopupFetch::Unchanged;
};
let wrapper: serde_json::Value = serde_json::from_str(resp.0.get())
.unwrap_or_default();
let result = wrapper.get("result").unwrap_or(&wrapper);
parse_auto_topup_response(result)
}
/// Map an `x.ai/auto-topup-rule` payload to an [`AutoTopupFetch`]. A body that
/// fails to deserialize is a fetch error (→ `Unchanged`, keep the cached rule),
/// not a definitive "no rule", so a malformed response can't silently flip the
/// credits warning.
pub(super) fn parse_auto_topup_response(
/// Parse an `x.ai/billing` ext response body (the unwrapped `result`
/// payload) into Kimi usage rows. A body that fails to deserialize is an
/// error, not an empty quota list, so a malformed response can't render
/// as "no usage data".
pub(super) fn parse_usage_response(
result: &serde_json::Value,
) -> crate::views::credit_bar::AutoTopupFetch {
use crate::views::credit_bar::{AutoTopupFetch, AutoTopupInfo};
use kigi_shell::extensions::billing::GetAutoTopupRuleResponse;
match serde_json::from_value::<GetAutoTopupRuleResponse>(result.clone()) {
Ok(parsed) => {
AutoTopupFetch::Resolved(
parsed
.rule
.map_or_else(
AutoTopupInfo::disabled,
|rule| AutoTopupInfo {
enabled: rule.enabled,
topup_amount_cents: rule.topup_amount.map(|c| c.val),
max_amount_cents: rule.max_amount_per_month.map(|c| c.val),
},
),
)
}
Err(_) => AutoTopupFetch::Unchanged,
}
) -> Result<Vec<kigi_shell::extensions::billing::UsageRow>, String> {
serde_json::from_value::<kigi_shell::extensions::billing::UsageResponse>(result.clone())
.map(|usage| usage.rows)
.map_err(|e| format!("Parse error: {e}"))
}
/// A blocking flock on the shared, possibly-network `~/.kigi` lock must never
/// stall the event-loop thread (and would hang exit on `/quit`); the registry
crates/codegen/kigi-tui/src/app/effects/mod.rs
+8 -278
View File
@@ -9,7 +9,6 @@ mod helpers;
use super::actions;
#[allow(unused_imports)]
use super::{agent, dispatch};
pub use helpers::ConversationsPartial;
pub(super) use helpers::parse_session_load_running_prompt_id;
pub(crate) use helpers::{
EffectMeta, RestoreProgressMsg, SessionFlags, persist_permission_mode_and_notify,
@@ -79,31 +78,6 @@ pub(crate) fn execute(
TaskResult::LogoutComplete
});
}
Effect::CheckSubscription { verify } => {
let tx = acp_tx.clone();
tasks.spawn(async move { send_check_subscription(&tx, verify).await });
}
Effect::CreditLimitRecheck { agent_id } => {
let tx = acp_tx.clone();
tasks.spawn(async move { send_credit_limit_recheck(&tx, agent_id).await });
}
Effect::SchedulePaywallCheck => {
tasks
.spawn(async move {
tokio::time::sleep(std::time::Duration::from_secs(5)).await;
TaskResult::PaywallCheckTick
});
}
Effect::ScheduleGateVerifyTimeout { generation } => {
tasks
.spawn(async move {
tokio::time::sleep(crate::app::subscription::GATE_VERIFY_TIMEOUT)
.await;
TaskResult::GateVerifyTimeout {
generation,
}
});
}
Effect::SwitchAccount { request_seq, method_id, use_oauth } => {
let tx = acp_tx.clone();
let abort_handle = tasks
@@ -717,10 +691,8 @@ pub(crate) fn execute(
}
let payload = wrapper.get("result").unwrap_or(&wrapper);
let sessions = parse_session_picker_entries(payload);
let partial = parse_session_list_partial(payload);
TaskResult::SessionListLoaded {
sessions,
partial,
seq,
query,
}
@@ -2414,66 +2386,6 @@ pub(crate) fn execute(
}
});
}
Effect::ShareSession { agent_id, session_id } => {
use kigi_shell::session::{ShareSessionRequest, ShareSessionResponse};
let tx = acp_tx.clone();
tasks
.spawn(async move {
let request = acp::ExtRequest::new(
"x.ai/share_session",
serde_json::value::to_raw_value(
&ShareSessionRequest {
session_id: session_id.0.to_string(),
},
)
.expect("serialize share session params")
.into(),
);
match acp_send(request, &tx).await {
Ok(resp) => {
let wrapper: serde_json::Value = serde_json::from_str(
resp.0.get(),
)
.unwrap_or_default();
if let Some(err) = wrapper.get("error") {
let msg = err
.as_str()
.map(String::from)
.unwrap_or_else(|| "unknown error".to_string());
return TaskResult::ShareSessionFailed {
agent_id,
error: msg,
};
}
let inner = wrapper.get("result").unwrap_or(&wrapper);
match serde_json::from_value::<
ShareSessionResponse,
>(inner.clone()) {
Ok(share_resp) => {
TaskResult::ShareSessionComplete {
agent_id,
share_url: share_resp.share_url,
}
}
Err(_) => {
TaskResult::ShareSessionFailed {
agent_id,
error: "couldn't share session".to_string(),
}
}
}
}
Err(e) => {
TaskResult::ShareSessionFailed {
agent_id,
error: sanitize_user_error(
&format!("couldn't share session: {e}"),
),
}
}
}
});
}
Effect::FetchSessionAgentName { agent_id, session_id } => {
let tx = acp_tx.clone();
tasks
@@ -2638,68 +2550,6 @@ pub(crate) fn execute(
}
});
}
Effect::SetCodingDataSharing { agent_id, opted_in, rollback_to_opted_in } => {
let tx = acp_tx.clone();
tasks
.spawn(async move {
let request = acp::ExtRequest::new(
"x.ai/privacy/setCodingDataRetention",
serde_json::value::to_raw_value(
&serde_json::json!(
{ "codingDataRetentionOptOut" : ! opted_in }
),
)
.expect("serialize params")
.into(),
);
match acp_send(request, &tx).await {
Ok(resp) => {
let wrapper: serde_json::Value = match serde_json::from_str(
resp.0.get(),
) {
Ok(v) => v,
Err(e) => {
return TaskResult::CodingDataSharingFailed {
agent_id,
error: format!("malformed response: {e}"),
rollback_to_opted_in,
};
}
};
if let Some(err) = wrapper
.get("error")
.filter(|v| !v.is_null())
{
let msg = err
.as_str()
.map(String::from)
.unwrap_or_else(|| err.to_string());
return TaskResult::CodingDataSharingFailed {
agent_id,
error: msg,
rollback_to_opted_in,
};
}
let confirmed_opted_in = wrapper
.get("codingDataRetentionOptOut")
.and_then(|v| v.as_bool())
.map(|opt_out| !opt_out)
.unwrap_or(opted_in);
TaskResult::CodingDataSharingUpdated {
agent_id,
opted_in: confirmed_opted_in,
}
}
Err(e) => {
TaskResult::CodingDataSharingFailed {
agent_id,
error: format!("{e}"),
rollback_to_opted_in,
}
}
}
});
}
Effect::ShowContextInfo { agent_id, session_id } => {
let tx = acp_tx.clone();
tasks
@@ -3453,150 +3303,30 @@ pub(crate) fn execute(
}
});
}
Effect::FetchBilling { agent_id, silent } => {
Effect::FetchUsage { agent_id } => {
let tx = acp_tx.clone();
tasks
.spawn(async move {
use kigi_shell::extensions::billing::BillingConfigResponse;
let req = acp::ExtRequest::new(
"x.ai/billing",
serde_json::value::to_raw_value(&serde_json::json!({}))
.expect("serialize billing params")
.expect("serialize usage params")
.into(),
);
let parsed = match acp_send(req, &tx).await {
let result = match acp_send(req, &tx).await {
Ok(resp) => {
let wrapper: serde_json::Value = serde_json::from_str(
resp.0.get(),
)
.unwrap_or_default();
let result = wrapper.get("result").unwrap_or(&wrapper);
serde_json::from_value::<
BillingConfigResponse,
>(result.clone())
}
Err(e) => {
return TaskResult::BillingError {
agent_id,
error: sanitize_user_error(&format!("{e}")),
silent,
};
let payload = wrapper.get("result").unwrap_or(&wrapper);
parse_usage_response(payload)
}
Err(e) => Err(sanitize_user_error(&format!("{e}"))),
};
let billing = match parsed {
Ok(billing) => billing,
Err(e) => {
return TaskResult::BillingError {
agent_id,
error: format!("Parse error: {e}"),
silent,
};
}
};
let subscription_tier = billing.subscription_tier;
let balance = billing.config.map(credit_balance_from_config);
let autotopup = if has_prepaid_credits(balance.as_ref()) {
fetch_auto_topup_info(&tx).await
} else {
crate::views::credit_bar::AutoTopupFetch::Cleared
};
TaskResult::BillingFetched {
TaskResult::UsageFetched {
agent_id,
balance,
silent,
subscription_tier,
autotopup,
}
});
}
Effect::RefreshGate => {
tasks
.spawn(async move {
let settings = tokio::task::spawn_blocking(|| {
if !kigi_shell::util::config::resolve_remote_fetch_enabled() {
return None;
}
let kigi_home = kigi_shell::util::kigi_home::kigi_home();
let store = kigi_shell::auth::read_auth_json(
&kigi_home.join("auth.json"),
)
.ok()?;
let scope = kigi_shell::auth::KimiCodeConfig::default()
.auth_scope();
let auth = kigi_shell::auth::lookup_auth(
&store,
&scope,
)?;
let proxy_base = std::env::var(
"KIGI_CLI_CHAT_PROXY_BASE_URL",
)
.unwrap_or_else(|_| kigi_env::coding_api_base_url());
kigi_shell::remote::fetch_settings_blocking(
&proxy_base,
&auth,
None,
)
})
.await
.ok()
.flatten();
TaskResult::GateRefreshed {
settings,
}
});
}
Effect::FetchAppBilling => {
let tx = acp_tx.clone();
tasks
.spawn(async move {
use kigi_shell::extensions::billing::BillingConfigResponse;
let req = acp::ExtRequest::new(
"x.ai/billing",
serde_json::value::to_raw_value(&serde_json::json!({}))
.expect("serialize billing params")
.into(),
);
match acp_send(req, &tx).await {
Ok(resp) => {
let wrapper: serde_json::Value = serde_json::from_str(
resp.0.get(),
)
.unwrap_or_default();
let result = wrapper.get("result").unwrap_or(&wrapper);
match serde_json::from_value::<
BillingConfigResponse,
>(result.clone()) {
Ok(billing) => {
let balance = billing
.config
.map(|c| crate::views::credit_bar::CreditBalance {
period_end_display: None,
..credit_balance_from_config(c)
});
let autotopup = if has_prepaid_credits(balance.as_ref()) {
fetch_auto_topup_info(&tx).await
} else {
crate::views::credit_bar::AutoTopupFetch::Cleared
};
TaskResult::AppBillingFetched {
balance,
autotopup,
}
}
Err(_) => {
TaskResult::AppBillingFetched {
balance: None,
autotopup: crate::views::credit_bar::AutoTopupFetch::Unchanged,
}
}
}
}
Err(_) => {
TaskResult::AppBillingFetched {
balance: None,
autotopup: crate::views::credit_bar::AutoTopupFetch::Unchanged,
}
}
result,
}
});
}
crates/codegen/kigi-tui/src/app/effects/tests.rs
+49 -276
View File
@@ -1,6 +1,5 @@
#![cfg_attr(rustfmt, rustfmt::skip)]
use super::*;
use kigi_shell::extensions::billing::{BillingConfig, Cent, UsagePeriod};
/// The invalid-params server detail survives `attach_prompt_usage`
/// wrapping `error.data` as `{message, promptUsage}`.
#[test]
@@ -23,7 +22,7 @@ fn format_acp_error_rate_limit_is_auth_aware() {
RATE_LIMITED_USER_MESSAGE_OAUTH,
};
let err = acp::Error::new(RATE_LIMITED_ERROR_CODE, "Rate limited").data("slow down");
assert_eq!(format_acp_error(& err, false), RATE_LIMITED_USER_MESSAGE_OAUTH);
assert_eq!(format_acp_error(&err, false), RATE_LIMITED_USER_MESSAGE_OAUTH.as_str());
assert_eq!(format_acp_error(& err, true), RATE_LIMITED_USER_MESSAGE_API_KEY);
}
/// Non-empty token ranges ride the wire block meta as `skillTokenRanges`
@@ -138,43 +137,6 @@ fn picker_still_drops_build_row_with_empty_summary() {
assert!(entries.is_empty(), "empty-summary Build rows stay dropped");
}
#[test]
fn session_list_partial_parses_reasons() {
let payload = |reason: &str| {
serde_json::json!(
{ "sessions" : [], "_meta" : { "x.ai/partial" : { "conversations" : true,
"reason" : reason } } }
)
};
assert_eq!(
parse_session_list_partial(& payload("no_oauth")),
Some(ConversationsPartial::NoOauth)
);
assert_eq!(
parse_session_list_partial(& payload("timeout")),
Some(ConversationsPartial::Timeout)
);
assert_eq!(
parse_session_list_partial(& payload("error")), Some(ConversationsPartial::Error)
);
assert_eq!(
parse_session_list_partial(& payload("something_new")),
Some(ConversationsPartial::Error)
);
}
#[test]
fn session_list_partial_absent_for_healthy_or_meta_less_responses() {
let healthy = serde_json::json!(
{ "sessions" : [], "_meta" : { "x.ai/partial" : { "conversations" : false } } }
);
assert_eq!(parse_session_list_partial(& healthy), None);
let legacy = serde_json::json!({ "sessions" : [] });
assert_eq!(parse_session_list_partial(& legacy), None);
}
/// The agent serializes `ExtMethodResult<KillTaskResponse>`: the outcome
/// lives at `result.outcome`. Probing the top level (the pre-fix code)
/// was why the tasks-pane ✗ never removed stale (`not_found`) rows after
/// a session resume.
#[test]
fn parse_kill_outcome_reads_result_envelope() {
use kigi_tools::types::KillOutcome;
let resp = r#"{"result":{"taskId":"t-1","outcome":"not_found"}}"#;
@@ -315,250 +277,61 @@ fn interject_params_carry_content_when_blocks_present() {
assert_eq!(content.len(), 1);
assert_eq!(content[0] ["text"], "look at [Image #1]");
}
/// A billing config with every field unset, for use as a base in
/// `credit_balance_from_config` tests via struct-update syntax.
fn empty_billing_config() -> BillingConfig {
BillingConfig {
credit_usage_percent: None,
current_period: None,
monthly_limit: None,
used: None,
on_demand_cap: None,
on_demand_used: None,
prepaid_balance: None,
is_unified_billing_user: None,
billing_period_start: None,
billing_period_end: None,
history: vec![],
}
}
/// `x.ai/billing` ext result (a serialized shell `UsageResponse`) parses
/// into typed rows; unknown labels/reset hints survive the round trip.
#[test]
fn credit_balance_prefers_credit_usage_percent_over_limit_used() {
let c = BillingConfig {
credit_usage_percent: Some(42.0),
monthly_limit: Some(Cent { val: 10_000 }),
used: Some(Cent { val: 9_000 }),
..empty_billing_config()
};
assert_eq!(credit_balance_from_config(c).usage_pct, 42.0);
fn parse_usage_response_reads_rows_from_fixture() {
let fixture = serde_json::json!({
"rows": [
{
"label": "Weekly limit",
"used": 250,
"limit": 1000,
"resetHint": "resets in 2d 1h"
},
{ "label": "5h limit", "used": 20, "limit": 50 }
]
});
let rows = parse_usage_response(&fixture).expect("fixture must parse");
assert_eq!(rows.len(), 2);
assert_eq!(rows[0].label, "Weekly limit");
assert_eq!(rows[0].used, 250);
assert_eq!(rows[0].limit, 1000);
assert_eq!(rows[0].reset_hint.as_deref(), Some("resets in 2d 1h"));
assert_eq!(rows[1].label, "5h limit");
assert!(rows[1].reset_hint.is_none());
}
/// Round-trip through the shell's own serializer: what the billing
/// extension emits must parse back to the same typed rows.
#[test]
fn credit_balance_forwards_is_unified_billing_user() {
let c = BillingConfig {
is_unified_billing_user: Some(true),
..empty_billing_config()
};
assert_eq!(credit_balance_from_config(c).is_unified_billing_user, Some(true));
assert_eq!(
credit_balance_from_config(empty_billing_config()).is_unified_billing_user, None
);
fn parse_usage_response_round_trips_shell_serialization() {
use kigi_shell::extensions::billing::{UsageResponse, UsageRow};
let wire = serde_json::to_value(&UsageResponse {
rows: vec![UsageRow {
label: "RPM".into(),
used: 12,
limit: 60,
reset_hint: None,
}],
})
.expect("serialize");
let rows = parse_usage_response(&wire).expect("round trip");
assert_eq!(rows.len(), 1);
assert_eq!(rows[0].label, "RPM");
assert_eq!(rows[0].used, 12);
assert_eq!(rows[0].limit, 60);
}
/// Empty rows parse to an empty list (→ "No usage data available." in the
/// dispatch layer); a malformed body is an error, not an empty quota list.
#[test]
fn credit_balance_falls_back_to_limit_used_when_percent_absent() {
let c = BillingConfig {
monthly_limit: Some(Cent { val: 10_000 }),
used: Some(Cent { val: 2_500 }),
..empty_billing_config()
};
assert_eq!(credit_balance_from_config(c).usage_pct, 25.0);
}
/// Match production: RFC 3339 → user's local wall-clock (no zone label).
fn expected_period_end_display(rfc3339: &str) -> String {
chrono::DateTime::parse_from_rfc3339(rfc3339)
.expect("test fixture is valid RFC 3339")
.with_timezone(&chrono::Local)
.format("%B %-d, %H:%M")
.to_string()
}
#[test]
fn credit_balance_prefers_current_period_end_over_billing_period_end() {
let end = "2026-06-08T20:00:00Z";
let c = BillingConfig {
credit_usage_percent: Some(10.0),
current_period: Some(UsagePeriod {
period_type: Some("USAGE_PERIOD_TYPE_WEEKLY".into()),
start: Some("2026-06-01T00:00:00Z".into()),
end: Some(end.into()),
}),
billing_period_end: Some("2026-07-01T20:00:00Z".into()),
..empty_billing_config()
};
assert_eq!(
credit_balance_from_config(c).period_end_display.as_deref(),
Some(expected_period_end_display(end).as_str())
);
}
#[test]
fn credit_balance_period_end_uses_local_timezone() {
let winter = "2026-01-15T20:00:00Z";
let summer = "2026-07-15T20:00:00Z";
let winter_cfg = BillingConfig {
billing_period_end: Some(winter.into()),
..empty_billing_config()
};
let summer_cfg = BillingConfig {
billing_period_end: Some(summer.into()),
..empty_billing_config()
};
assert_eq!(
credit_balance_from_config(winter_cfg).period_end_display.as_deref(),
Some(expected_period_end_display(winter).as_str())
);
assert_eq!(
credit_balance_from_config(summer_cfg).period_end_display.as_deref(),
Some(expected_period_end_display(summer).as_str())
);
assert_ne!(expected_period_end_display(winter), expected_period_end_display(summer));
}
#[test]
fn credit_balance_falls_back_to_billing_period_end() {
let end = "2026-07-01T20:00:00Z";
let c = BillingConfig {
billing_period_end: Some(end.into()),
..empty_billing_config()
};
assert_eq!(
credit_balance_from_config(c).period_end_display.as_deref(),
Some(expected_period_end_display(end).as_str())
);
}
#[test]
fn credit_balance_period_end_falls_back_when_current_period_has_no_end() {
let end = "2026-07-01T20:00:00Z";
let c = BillingConfig {
current_period: Some(UsagePeriod {
period_type: None,
start: Some("2026-06-01T00:00:00Z".into()),
end: None,
}),
billing_period_end: Some(end.into()),
..empty_billing_config()
};
assert_eq!(
credit_balance_from_config(c).period_end_display.as_deref(),
Some(expected_period_end_display(end).as_str())
);
}
#[test]
fn credit_balance_period_end_none_when_unavailable() {
fn parse_usage_response_empty_and_malformed() {
assert!(
credit_balance_from_config(empty_billing_config()).period_end_display.is_none()
parse_usage_response(&serde_json::json!({ "rows": [] }))
.expect("empty rows parse")
.is_empty()
);
}
#[test]
fn credit_balance_clamps_new_percent_above_100() {
let c = BillingConfig {
credit_usage_percent: Some(150.0),
..empty_billing_config()
};
assert_eq!(credit_balance_from_config(c).usage_pct, 100.0);
}
#[test]
fn credit_balance_clamps_legacy_used_above_limit() {
let c = BillingConfig {
monthly_limit: Some(Cent { val: 1_000 }),
used: Some(Cent { val: 2_500 }),
..empty_billing_config()
};
assert_eq!(credit_balance_from_config(c).usage_pct, 100.0);
}
#[test]
fn credit_balance_effective_equals_usage_when_no_on_demand() {
let c = BillingConfig {
credit_usage_percent: Some(40.0),
..empty_billing_config()
};
let bal = credit_balance_from_config(c);
assert!(! bal.pay_as_you_go);
assert_eq!(bal.on_demand_cap_cents, None);
assert_eq!(bal.effective_usage_pct, 40.0);
}
#[test]
fn credit_balance_effective_uses_on_demand_ratio_when_included_exhausted() {
let c = BillingConfig {
credit_usage_percent: Some(100.0),
on_demand_cap: Some(Cent { val: 5_000 }),
on_demand_used: Some(Cent { val: 1_000 }),
..empty_billing_config()
};
let bal = credit_balance_from_config(c);
assert!(bal.pay_as_you_go);
assert_eq!(bal.usage_pct, 100.0);
assert_eq!(bal.effective_usage_pct, 20.0);
assert_eq!(bal.on_demand_cap_cents, Some(5_000));
assert_eq!(bal.on_demand_used_cents, Some(1_000));
}
#[test]
fn parse_auto_topup_present_rule_resolves() {
let v = serde_json::json!(
{ "rule" : { "enabled" : true, "topupAmount" : { "val" : 2000 },
"maxAmountPerMonth" : { "val" : 10000 } } }
);
match parse_auto_topup_response(&v) {
crate::views::credit_bar::AutoTopupFetch::Resolved(at) => {
assert!(at.enabled);
assert_eq!(at.topup_amount_cents, Some(2000));
assert_eq!(at.max_amount_cents, Some(10000));
}
other => panic!("expected Resolved, got {other:?}"),
}
}
#[test]
fn parse_auto_topup_empty_body_resolves_to_disabled() {
for v in [serde_json::json!({}), serde_json::json!({ "rule" : null })] {
match parse_auto_topup_response(&v) {
crate::views::credit_bar::AutoTopupFetch::Resolved(at) => {
assert!(! at.enabled);
}
other => panic!("expected Resolved(disabled), got {other:?}"),
}
}
}
#[test]
fn parse_auto_topup_rule_without_enabled_is_disabled() {
let v = serde_json::json!({ "rule" : { "topupAmount" : { "val" : 500 } } });
match parse_auto_topup_response(&v) {
crate::views::credit_bar::AutoTopupFetch::Resolved(at) => {
assert!(! at.enabled);
assert_eq!(at.topup_amount_cents, Some(500));
}
other => panic!("expected Resolved(disabled), got {other:?}"),
}
}
#[test]
fn parse_auto_topup_malformed_body_is_unchanged() {
for v in [serde_json::json!(null), serde_json::json!(42)] {
match parse_auto_topup_response(&v) {
crate::views::credit_bar::AutoTopupFetch::Unchanged => {}
other => panic!("expected Unchanged, got {other:?}"),
}
}
}
#[test]
fn credit_balance_effective_tracks_included_for_new_shape_under_100() {
let c = BillingConfig {
credit_usage_percent: Some(95.0),
on_demand_cap: Some(Cent { val: 5_000 }),
on_demand_used: Some(Cent { val: 0 }),
..empty_billing_config()
};
let bal = credit_balance_from_config(c);
assert!(bal.pay_as_you_go);
assert_eq!(bal.effective_usage_pct, 95.0);
}
#[test]
fn credit_balance_effective_blends_budget_for_legacy_shape_under_100() {
let c = BillingConfig {
monthly_limit: Some(Cent { val: 10_000 }),
used: Some(Cent { val: 5_000 }),
on_demand_cap: Some(Cent { val: 10_000 }),
on_demand_used: Some(Cent { val: 0 }),
..empty_billing_config()
};
let bal = credit_balance_from_config(c);
assert!(bal.pay_as_you_go);
assert_eq!(bal.usage_pct, 50.0);
assert_eq!(bal.effective_usage_pct, 25.0);
assert!(parse_usage_response(&serde_json::json!({ "bogus": 1 })).is_err());
assert!(parse_usage_response(&serde_json::json!(null)).is_err());
}
#[test]
fn parse_worktree_restore_payload_full() {
crates/codegen/kigi-tui/src/app/event_loop.rs
+6 -156
View File
@@ -595,10 +595,6 @@ pub(crate) async fn run(
.as_ref()
.and_then(|s| s.show_resolved_model)
.unwrap_or(true);
app.sharing_enabled = remote_settings
.as_ref()
.and_then(|s| s.sharing_enabled)
.unwrap_or(false);
app.session_picker_grouped = std::env::var("KIGI_SESSION_PICKER_GROUPED")
.ok()
.and_then(|v| match v.as_str() {
@@ -681,7 +677,7 @@ pub(crate) async fn run(
// else: auth_state defaults to Done (already authenticated eagerly)
// Effects stashed until after the initial render, so the user sees the
// welcome/auth UI right away.
let mut post_render_effects = if needs_interactive_login {
let post_render_effects = if needs_interactive_login {
if connection.auth_methods.is_empty() {
app.auth_state = super::app_view::AuthState::Pending {
error: Some("No login method available".to_string()),
@@ -711,21 +707,6 @@ pub(crate) async fn run(
}
}
// Fallback: prefetch may have gate info the shell's AuthMeta missed.
// Errs on the side of blocking if stale.
if app.gate.is_none()
&& let Some(rs) = remote_settings.as_ref()
{
app.gate = AppView::gate_from_settings(rs);
}
// Re-impose the startup gate through the chokepoint: cached auth meta
// and the settings prefetch are both possibly stale, so a consumer
// session's gate is deferred for live verification before first paint.
if let Some(gate) = app.gate.take() {
post_render_effects.extend(app.impose_gate(gate));
}
// Load config layers once, resolve tips and feature flags.
let requirements = kigi_shell::config::load_merged_requirements();
let user_config = kigi_shell::config::load_from_disk().ok();
@@ -756,17 +737,6 @@ pub(crate) async fn run(
);
}
app.zdr_access_enabled = kigi_shell::util::config::resolve_zdr_access_enabled(
requirements.as_ref(),
user_config.as_ref(),
managed_config.as_ref(),
remote_settings.as_ref(),
);
app.subscription_watch_interval_secs = remote_settings
.as_ref()
.and_then(|rs| rs.subscription_watch_interval_secs);
// Full layered resolve (env/requirements/remote may beat plain `[ui]`).
crate::appearance::cache::set_show_thinking_blocks(
kigi_shell::util::config::resolve_show_thinking_blocks(
@@ -796,14 +766,6 @@ pub(crate) async fn run(
.value,
);
app.usage_billing_redirect_url = remote_settings
.as_ref()
.and_then(|s| s.usage_billing_redirect_url.clone());
if app.is_access_blocked() {
app.welcome_prompt_focused = false;
}
{
use kigi_shell::util::config::resolve_tips;
@@ -1124,20 +1086,6 @@ pub(crate) async fn run(
// iteration so it is popped on every close path.
let mut gboom_keyboard_pushed = false;
const BILLING_POLL_INTERVAL: Duration = Duration::from_secs(30);
let mut billing_poll_at: Option<Instant> = None;
const GATE_POLL_INTERVAL: Duration = Duration::from_secs(30);
let mut gate_poll_at: Option<Instant> = None;
// Free→paid subscription watch (see `app::subscription`).
let mut subscription_watch_at: Option<Instant> = if app.subscription_watch_wanted() {
app.subscription_watch_interval()
.map(|iv| Instant::now() + iv)
} else {
None
};
// Leader-mode roster poll (FleetView dashboard). Only fires while the
// dashboard is open AND we're connected via a leader. Armed to fire
// immediately at loop start so an already-open dashboard refreshes
@@ -1168,22 +1116,12 @@ pub(crate) async fn run(
if process_effects(effs, &mut tasks, &mut app, &progress_tx) {
return Ok(make_run_result(&app));
}
// Fetch billing early so the welcome screen can show a credit warning.
if app.usage_visible {
let effs = vec![super::actions::Effect::FetchAppBilling];
if process_effects(effs, &mut tasks, &mut app, &progress_tx) {
return Ok(make_run_result(&app));
}
}
// Fetch changelog off the render path so the welcome screen
// can display bullets and /release-notes uses the cached result.
let effs = vec![super::actions::Effect::FetchChangelog];
if process_effects(effs, &mut tasks, &mut app, &progress_tx) {
return Ok(make_run_result(&app));
}
if !app.has_access() {
gate_poll_at = Some(Instant::now() + GATE_POLL_INTERVAL);
}
}
if !post_render_effects.is_empty()
@@ -1276,16 +1214,14 @@ pub(crate) async fn run(
app.draw(terminal);
}
// Initial prompt from the CLI positional (`grok "fix the bug"`). When
// Initial prompt from the CLI positional (`kigi "fix the bug"`). When
// already authenticated, hand it to the shared dispatcher helper (same
// `NewSession`/`SendPrompt` path the welcome screen uses). ZDR-blocked
// accounts cannot start a session, so drop the prompt — this mirrors the
// deferred post-login path, which clears the startup prompt for ZDR-blocked
// accounts. When not yet authenticated, stash it for `AuthComplete`.
// `NewSession`/`SendPrompt` path the welcome screen uses). When not yet
// authenticated, stash it for `AuthComplete`.
if let Some(initial_prompt) = args.initial_prompt() {
if !app.session_startup_allowed() {
app.deferred_startup.prompt = Some(initial_prompt.to_string());
} else if !app.is_zdr_blocked() {
} else {
let effs = dispatch::dispatch_initial_prompt(&mut app, initial_prompt.to_string());
if process_effects(effs, &mut tasks, &mut app, &progress_tx) {
return Ok(make_run_result(&app));
@@ -1322,10 +1258,7 @@ pub(crate) async fn run(
// empty one so the user lands directly at the prompt. Unauthenticated /
// ZDR-blocked startup stays on Welcome, where `crate::minimal::live` shows
// a sign-in hint instead of a blank region.
if term_state.screen_mode.is_minimal()
&& matches!(app.active_view, ActiveView::Welcome)
&& !app.is_zdr_blocked()
{
if term_state.screen_mode.is_minimal() && matches!(app.active_view, ActiveView::Welcome) {
if app.session_startup_allowed() {
// Already authenticated + trusted: open the empty session now so the
// user lands directly at the prompt.
@@ -1456,15 +1389,6 @@ pub(crate) async fn run(
roster_poll_at = Some(Instant::now());
}
// (Re-)arm the subscription watch on the dormant→wanted transition
// and after each fired tick.
if subscription_watch_at.is_none()
&& app.subscription_watch_wanted()
&& let Some(iv) = app.subscription_watch_interval()
{
subscription_watch_at = Some(Instant::now() + iv);
}
// Future that sleeps until the next animation tick, or waits forever if none.
let animation_tick = async {
match animation_tick_at {
@@ -1511,27 +1435,6 @@ pub(crate) async fn run(
}
};
let billing_poll = async {
match billing_poll_at {
Some(at) => sleep_until(at).await,
None => std::future::pending().await,
}
};
let gate_poll = async {
match gate_poll_at {
Some(at) => sleep_until(at).await,
None => std::future::pending().await,
}
};
let subscription_watch = async {
match subscription_watch_at {
Some(at) => sleep_until(at).await,
None => std::future::pending().await,
}
};
let roster_poll = async {
match roster_poll_at {
Some(at) => sleep_until(at).await,
@@ -1629,18 +1532,6 @@ pub(crate) async fn run(
schedule_tick(&mut animation_tick_at, &app, tick_interval);
resize_debounce_at = None;
// Schedule/clear poll timers.
if app.billing_poll_wanted && billing_poll_at.is_none() {
billing_poll_at = Some(Instant::now() + BILLING_POLL_INTERVAL);
} else if !app.billing_poll_wanted {
billing_poll_at = None;
}
if !app.has_access() && gate_poll_at.is_none() {
gate_poll_at = Some(Instant::now() + GATE_POLL_INTERVAL);
} else if app.has_access() {
gate_poll_at = None;
}
app.draw(terminal);
last_draw_at = Instant::now();
draw_scheduled_at = None;
@@ -1810,41 +1701,6 @@ pub(crate) async fn run(
schedule_tick(&mut animation_tick_at, &app, tick_interval);
}
_ = billing_poll => {
billing_poll_at = None;
if let ActiveView::Agent(id) = app.active_view {
let effs = vec![Effect::FetchBilling {
agent_id: id,
silent: true,
}];
if process_effects(effs, &mut tasks, &mut app, &progress_tx) {
break;
}
}
if app.billing_poll_wanted {
billing_poll_at = Some(Instant::now() + BILLING_POLL_INTERVAL);
}
}
_ = gate_poll => {
gate_poll_at = None;
let effs = vec![Effect::RefreshGate];
if process_effects(effs, &mut tasks, &mut app, &progress_tx) {
break;
}
if !app.has_access() {
gate_poll_at = Some(Instant::now() + GATE_POLL_INTERVAL);
}
}
_ = subscription_watch => {
subscription_watch_at = None;
let effs = app.fire_subscription_check("watch");
if process_effects(effs, &mut tasks, &mut app, &progress_tx) {
break;
}
}
_ = roster_poll => {
roster_poll_at = None;
// Only poll while the dashboard is open. When it is not active
@@ -2519,12 +2375,6 @@ async fn drain_and_process(
{
crate::clipboard::prewarm_image_probe();
}
// The user may have just subscribed in the browser and
// tabbed back.
let effs = app.fire_subscription_check("focus");
if process_effects(effs, tasks, app, progress_tx) {
return true;
}
// Restore Prompt on refocus: needs-input overlay always, else idle non-vim.
match app.active_view {
ActiveView::Agent(id) => {
crates/codegen/kigi-tui/src/app/foreign_sessions.rs
-1
View File
@@ -34,7 +34,6 @@ impl AppView {
&& self.agents.is_empty()
&& self.next_agent_id == 0
&& !self.chat_mode
&& !self.is_zdr_blocked()
&& self.pending_update_version.is_none()
}
crates/codegen/kigi-tui/src/app/leader_cluster/mod.rs
+1 -1
View File
@@ -317,7 +317,7 @@ impl PagerLeaderCluster {
let env = vec![
crate::test_util::EnvVarGuard::set("KIGI_SHARE_DIR", kigi_home.path()),
crate::test_util::EnvVarGuard::set("KIGI_CLI_CHAT_PROXY_BASE_URL", server.url()),
crate::test_util::EnvVarGuard::set("KIGI_CODE_BASE_URL", server.url()),
crate::test_util::EnvVarGuard::set("KIGI_XAI_API_BASE_URL", server.url()),
crate::test_util::EnvVarGuard::set("XAI_API_KEY", "test-key-for-ci"),
crate::test_util::EnvVarGuard::set("KIGI_TELEMETRY_ENABLED", "false"),
crates/codegen/kigi-tui/src/app/mod.rs
+20 -106
View File
@@ -41,7 +41,6 @@ pub mod session_startup;
mod signal_handler;
pub mod status_blocks;
pub mod subagent;
pub mod subscription;
mod turn_completion;
mod xt_filter;
pub(crate) use crate::terminal::kitty_flags_pushed;
@@ -56,7 +55,6 @@ use crossterm::execute;
use crossterm::terminal::{
self, Clear, ClearType, EnterAlternateScreen, LeaveAlternateScreen, SetTitle,
};
pub(crate) use dispatch::{FREE_USAGE_USER_MESSAGE, acp_error_is_free_usage_exhausted};
pub use foreign_sessions::ForeignScanCoordinator;
pub(crate) use foreign_sessions::{
badge_for_picker_source, foreign_tool_display_label, is_foreign_picker_source,
@@ -272,7 +270,6 @@ pub fn resolve_use_leader(
leader_flag: bool,
no_leader_flag: bool,
raw_config: &toml::Value,
_remote_settings: Option<&kigi_shell::util::config::RemoteSettings>,
eligible: bool,
) -> (bool, Option<&'static str>) {
if no_leader_flag {
@@ -287,35 +284,8 @@ pub fn resolve_use_leader(
if let Some(v) = config::use_leader_from_toml_opt(raw_config) {
return (v, (!v).then_some("config"));
}
#[cfg(feature = "release-dist")]
if let Some(remote_val) = _remote_settings.and_then(|s| s.leader_mode) {
return (remote_val, (!remote_val).then_some("remote"));
}
(false, None)
}
/// Join early prefetch to get remote settings (with timeout).
///
/// Remote settings come from the product settings API and contain `leader_mode`,
/// feature gates, etc. Waits up to 2 s for the background thread.
pub fn join_early_prefetch(
handle: Option<kigi_shell::agent::models::EarlyPrefetchHandle>,
) -> Option<kigi_shell::util::config::RemoteSettings> {
let handle = handle?;
if handle.is_finished() {
return match handle.join() {
Ok(r) => r.settings,
Err(_) => None,
};
}
let (tx, rx) = std::sync::mpsc::channel();
std::thread::spawn(move || {
let _ = tx.send(handle.join());
});
match rx.recv_timeout(std::time::Duration::from_secs(2)) {
Ok(Ok(r)) => r.settings,
_ => None,
}
}
/// First non-blank of CLI > env > config (precedence + blank-skip). `None` →
/// nothing set; `acp::initialize` canonicalizes and applies the default.
fn resolve_hunk_tracker_mode(
@@ -360,27 +330,21 @@ pub async fn run(
}
};
let refreshed_auth = kigi_shell::auth::try_ensure_fresh_auth(&kimi_code_config).await;
let early_prefetch = kigi_shell::agent::models::start_early_prefetch_with_auth(refreshed_auth);
// Fire-and-forget model-catalog warmup; nothing joins the handle now that
// the xAI settings fetch it used to carry is gone.
drop(kigi_shell::agent::models::start_early_prefetch_with_auth(
refreshed_auth,
));
kigi_shell::agent::mvp_agent::warm_async_http_client();
tokio::task::spawn_blocking(|| {});
if let Ok(cwd) = std::env::current_dir() {
crate::git_info::populate_from_cwd_async(cwd);
}
let remote_settings = join_early_prefetch(early_prefetch);
kigi_shell::util::config::cache_remote_auto_mode(
remote_settings.as_ref().and_then(|s| s.auto_mode.clone()),
);
kigi_shell::util::config::set_remote_campaigns_from_settings(remote_settings.as_ref());
let raw_config = kigi_shell::config::load_effective_config()
.map_err(|e| anyhow::anyhow!("Failed to load config: {e}"))?;
let prefetch_elapsed = startup_start.elapsed();
let (use_leader, policy_disable_reason) = resolve_use_leader(
args.leader,
args.no_leader,
&raw_config,
remote_settings.as_ref(),
true,
);
let (use_leader, policy_disable_reason) =
resolve_use_leader(args.leader, args.no_leader, &raw_config, true);
tracing::info!(
use_leader,
?policy_disable_reason,
@@ -473,9 +437,7 @@ pub async fn run(
env_hunk_tracker_mode.as_deref(),
config_hunk_tracker_mode,
);
let remote_permission_mode = remote_settings
.as_ref()
.and_then(|s| s.permission_mode.as_deref());
let remote_permission_mode = None;
let launch_yolo = kigi_shell::util::config::effective_yolo_for_launch(
args.yolo,
args.permission_mode_flag.as_deref(),
@@ -500,7 +462,7 @@ pub async fn run(
fs_read: args.fs_read,
fs_write: args.fs_write,
installer: args.installer.clone(),
remote_settings: remote_settings.clone(),
remote_settings: None,
system_prompt_override: args.system_prompt_override.clone(),
rules: args.rules.clone(),
reasoning_effort_override: args
@@ -613,7 +575,7 @@ pub async fn run(
&mut config_watcher,
&effective_args,
session_cwd,
remote_settings,
None,
term_state,
materialized,
bg_update_rx,
@@ -1305,47 +1267,47 @@ mod tests {
#[test]
fn no_leader_flag_wins_over_leader_flag_and_config() {
let cfg = config_with_leader(true);
let (use_leader, reason) = resolve_use_leader(true, true, &cfg, None, true);
let (use_leader, reason) = resolve_use_leader(true, true, &cfg, true);
assert!(!use_leader);
assert_eq!(reason, None);
}
#[test]
fn leader_flag_enables() {
let (use_leader, reason) = resolve_use_leader(true, false, &empty_config(), None, true);
let (use_leader, reason) = resolve_use_leader(true, false, &empty_config(), true);
assert!(use_leader);
assert_eq!(reason, None);
}
#[test]
fn not_eligible_returns_false() {
let cfg = config_with_leader(true);
let (use_leader, reason) = resolve_use_leader(false, false, &cfg, None, false);
let (use_leader, reason) = resolve_use_leader(false, false, &cfg, false);
assert!(!use_leader);
assert_eq!(reason, None);
}
#[test]
fn config_toml_enables() {
let cfg = config_with_leader(true);
let (use_leader, reason) = resolve_use_leader(false, false, &cfg, None, true);
let (use_leader, reason) = resolve_use_leader(false, false, &cfg, true);
assert!(use_leader);
assert_eq!(reason, None);
}
#[test]
fn config_toml_disables() {
let cfg = config_with_leader(false);
let (use_leader, reason) = resolve_use_leader(false, false, &cfg, None, true);
let (use_leader, reason) = resolve_use_leader(false, false, &cfg, true);
assert!(!use_leader);
assert_eq!(reason, Some("config"));
}
#[test]
fn default_is_false() {
let (use_leader, reason) = resolve_use_leader(false, false, &empty_config(), None, true);
let (use_leader, reason) = resolve_use_leader(false, false, &empty_config(), true);
assert!(!use_leader);
assert_eq!(reason, None);
}
#[test]
fn cli_flag_overrides_config() {
let cfg = config_with_leader(false);
let (use_leader, reason) = resolve_use_leader(true, false, &cfg, None, true);
let (use_leader, reason) = resolve_use_leader(true, false, &cfg, true);
assert!(use_leader);
assert_eq!(reason, None);
}
@@ -1379,7 +1341,7 @@ mod tests {
#[test]
fn no_leader_flag_overrides_config_for_tui_fallback() {
let cfg = config_with_leader(true);
let (use_leader, reason) = resolve_use_leader(false, true, &cfg, None, true);
let (use_leader, reason) = resolve_use_leader(false, true, &cfg, true);
assert!(!use_leader);
assert_eq!(reason, None);
}
@@ -1405,59 +1367,11 @@ mod tests {
assert!(try_parse_pager(&["grok-pager", "agent"]).is_err());
}
#[test]
fn remote_settings_none_falls_through_to_default() {
let (use_leader, reason) = resolve_use_leader(false, false, &empty_config(), None, true);
fn leader_defaults_off_without_config() {
let (use_leader, reason) = resolve_use_leader(false, false, &empty_config(), true);
assert!(!use_leader);
assert_eq!(reason, None);
}
#[cfg(feature = "release-dist")]
#[test]
fn remote_settings_leader_mode_true_enables_leader() {
let rs = kigi_shell::util::config::RemoteSettings {
leader_mode: Some(true),
..Default::default()
};
let (use_leader, reason) =
resolve_use_leader(false, false, &empty_config(), Some(&rs), true);
assert!(use_leader);
assert_eq!(reason, None);
}
#[cfg(feature = "release-dist")]
#[test]
fn remote_settings_leader_mode_false_disables_leader() {
let rs = kigi_shell::util::config::RemoteSettings {
leader_mode: Some(false),
..Default::default()
};
let (use_leader, reason) =
resolve_use_leader(false, false, &empty_config(), Some(&rs), true);
assert!(!use_leader);
assert_eq!(reason, Some("remote"));
}
#[cfg(feature = "release-dist")]
#[test]
fn remote_settings_unknown_leader_mode_is_not_policy_disable() {
let rs = kigi_shell::util::config::RemoteSettings {
leader_mode: None,
..Default::default()
};
let (use_leader, reason) =
resolve_use_leader(false, false, &empty_config(), Some(&rs), true);
assert!(!use_leader);
assert_eq!(reason, None);
}
#[cfg(feature = "release-dist")]
#[test]
fn config_toml_overrides_remote_settings() {
let rs = kigi_shell::util::config::RemoteSettings {
leader_mode: Some(true),
..Default::default()
};
let cfg = config_with_leader(false);
let (use_leader, reason) = resolve_use_leader(false, false, &cfg, Some(&rs), true);
assert!(!use_leader);
assert_eq!(reason, Some("config"));
}
#[test]
fn cli_resume_parses_session_id() {
let args = try_parse_pager(&["grok-pager", "--resume", "abc-123"]).unwrap();
crates/codegen/kigi-tui/src/app/modals.rs
+4 -9
View File
@@ -635,8 +635,7 @@ impl AgentView {
entries: _, state, ..
} => {
// Build filtered entries for count and non-selectable indices.
let filtered =
crate::views::modal::filter_palette_entries(&state.query, self.sharing_enabled);
let filtered = crate::views::modal::filter_palette_entries(&state.query);
let non_sel: Vec<bool> = filtered
.iter()
.map(|e| matches!(e.command, PaletteCommand::SectionHeader(_)))
@@ -840,14 +839,10 @@ impl AgentView {
}
PickerOutcome::Changed => {
// Re-filter entries based on updated query.
let sharing_enabled = self.sharing_enabled;
if let Some(ActiveModal::CommandPalette { entries, state, .. }) =
self.active_modal.as_mut()
{
*entries = crate::views::modal::filter_palette_entries(
&state.query,
sharing_enabled,
);
*entries = crate::views::modal::filter_palette_entries(&state.query);
state.selected = state.selected.min(entries.len().saturating_sub(1));
}
InputOutcome::Changed
@@ -1623,7 +1618,7 @@ impl AgentView {
} = active_modal
{
// Command palette: ModalWindow chrome + picker content.
let filtered = modal::filter_palette_entries(&state.query, self.sharing_enabled);
let filtered = modal::filter_palette_entries(&state.query);
let non_sel: Vec<bool> = filtered
.iter()
.map(|e| matches!(e.command, modal::PaletteCommand::SectionHeader(_)))
@@ -2614,7 +2609,7 @@ mod command_palette_vim_input_tests {
// INPUT mode (`input_active`) over the full palette entries.
fn open_command_palette(agent: &mut AgentView) {
agent.active_modal = Some(ActiveModal::CommandPalette {
entries: crate::views::modal::default_palette_entries(agent.sharing_enabled),
entries: crate::views::modal::default_palette_entries(),
state: PickerState::input_active(),
window: crate::views::modal_window::ModalWindowState::new(),
});
crates/codegen/kigi-tui/src/app/mouse.rs
-26
View File
@@ -698,31 +698,6 @@ impl AgentView {
.scrollback
.entry_index_at_screen_row(click_row, self.pane_areas.scrollback);
if let Some(idx) = hit_idx {
let credit_click = self.scrollback.entry(idx).and_then(|entry| {
if let crate::scrollback::block::RenderBlock::CreditLimit(ref blk) =
entry.block
{
Some(blk.url.clone())
} else {
None
}
});
if let Some(url) = credit_click
&& let Some((area, _, _)) = self
.scrollback
.entry_screen_area(idx, self.pane_areas.scrollback)
{
let url_row = area.y + area.height.saturating_sub(2);
if click_row >= url_row {
self.scrollback.set_selected(Some(idx));
crate::app::link_opener::open_url_if_safe(
&url,
crate::terminal::hyperlinks::SchemeFilter::Standard,
);
self.last_click = None;
return InputOutcome::Changed;
}
}
let selectable = self
.scrollback
.get(idx)
@@ -878,7 +853,6 @@ impl AgentView {
.set_hovered_follow_up_chip(self.follow_up_chip_at(mouse.column, mouse.row));
changed |= self.hit_badge.update_hover(mouse.column, mouse.row);
changed |= self.hit_context.update_hover(mouse.column, mouse.row);
changed |= self.hit_credits.update_hover(mouse.column, mouse.row);
changed |= self.hit_todo_close.update_hover(mouse.column, mouse.row);
changed |= self.hit_queue_close.update_hover(mouse.column, mouse.row);
changed |= self.hit_queue_badge.update_hover(mouse.column, mouse.row);
crates/codegen/kigi-tui/src/app/queue_edit.rs
+1 -1
View File
@@ -1150,7 +1150,7 @@ mod tests {
// early-return) is what leaves the palette alone.
agent.prompt_mode = editing_lone_local();
agent.active_modal = Some(ActiveModal::CommandPalette {
entries: crate::views::modal::default_palette_entries(agent.sharing_enabled),
entries: crate::views::modal::default_palette_entries(),
state: crate::views::picker::PickerState::input_active(),
window: crate::views::modal_window::ModalWindowState::new(),
});
crates/codegen/kigi-tui/src/app/subagent.rs
-2
View File
@@ -561,8 +561,6 @@ mod tests {
restore_degree: None,
rate_limited: false,
model_incompatible: false,
credit_limit_blocked: false,
free_usage_blocked: false,
available_commands: Vec::new(),
available_commands_generation: 0,
available_tools: None,
crates/codegen/kigi-tui/src/app/subscription.rs
-487
View File
@@ -1,487 +0,0 @@
//! Free→paid subscription detection and gate imposition/lift.
//!
//! All gate transitions go through [`AppView::impose_gate`] /
//! [`AppView::lift_gate`] so the defer-vs-show decision and the lift
//! bookkeeping (focus, telemetry, JWT-refresh check) live in one place.
//!
//! Design constraints that are not obvious from the code:
//! - Gates arriving from cached auth meta, prefetched settings, or settings
//! pushes can be stale: the user may have subscribed since the snapshot
//! was computed. Painting such a gate directly flashes a paywall at a
//! paying user, so it is held in `pending_gate_verification` while a live
//! check runs. On check failure or timeout we err on blocking.
//! - Timer effects have no cancellation, so verifications are stamped with
//! `gate_verify_gen`; results and timeouts from superseded deferrals are
//! ignored by generation mismatch.
use super::actions::Effect;
use super::app_view::{AppView, AuthState};
/// Default watch cadence. Overridable via the remote settings
/// `grok_build_settings.subscription_watch_interval_secs` field.
pub(crate) const SUBSCRIPTION_WATCH_INTERVAL: std::time::Duration =
std::time::Duration::from_secs(60);
/// Floor for the server-supplied cadence: a fat-fingered remote settings value
/// must not turn the fleet into a hot-poller. `0` means "disabled" and is
/// special-cased before this clamp.
pub(crate) const SUBSCRIPTION_WATCH_MIN_INTERVAL_SECS: u64 = 30;
/// Floor for the `KIGI_SUBSCRIPTION_WATCH_INTERVAL_SECS` env override
/// (test seam / power user — deliberately below the server floor).
const SUBSCRIPTION_WATCH_ENV_MIN_SECS: u64 = 1;
/// Cap on the spacing between watch/focus-triggered checks.
pub(crate) const SUBSCRIPTION_CHECK_DEBOUNCE: std::time::Duration =
std::time::Duration::from_secs(30);
/// How long a deferred gate is held before being shown anyway. This is a
/// safety net for a hung ACP round-trip only — a completed check (even a
/// failed one) resolves the deferral immediately. Generous on purpose: the
/// check can chain a `/user` fetch, a JWT refresh, and a settings re-fetch;
/// 5s was observed timing out in CI under full-suite contention.
pub(crate) const GATE_VERIFY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
impl AppView {
/// Consumer xAI session auth: not an API key, not an enterprise team.
/// Subscription gates and the watch only apply to these sessions.
fn is_consumer_session(&self) -> bool {
matches!(self.auth_state, AuthState::Done)
&& !self.is_api_key_auth
&& self.team_name.is_none()
}
/// `None` tier counts as potentially-free so detection works before the
/// first auth meta lands. Not a confirmed-free signal.
pub fn may_be_free_tier(&self) -> bool {
match self.subscription_tier.as_deref() {
Some(t) => t.trim().eq_ignore_ascii_case("free"),
None => true,
}
}
/// Effective watch cadence; `None` = disabled. Precedence: env override
/// (`0` disables), server override (`0` disables, floor-clamped),
/// default.
pub fn subscription_watch_interval(&self) -> Option<std::time::Duration> {
if let Ok(v) = std::env::var("KIGI_SUBSCRIPTION_WATCH_INTERVAL_SECS")
&& let Ok(secs) = v.trim().parse::<u64>()
{
return match secs {
0 => None,
s => Some(std::time::Duration::from_secs(
s.max(SUBSCRIPTION_WATCH_ENV_MIN_SECS),
)),
};
}
match self.subscription_watch_interval_secs {
Some(0) => None,
Some(secs) => Some(std::time::Duration::from_secs(
secs.max(SUBSCRIPTION_WATCH_MIN_INTERVAL_SECS),
)),
None => Some(SUBSCRIPTION_WATCH_INTERVAL),
}
}
/// Whether the watch (and the refocus check) should run: enabled,
/// consumer session, and gated or possibly-free.
pub fn subscription_watch_wanted(&self) -> bool {
self.subscription_watch_interval().is_some()
&& self.is_consumer_session()
&& (self.gate.is_some() || self.may_be_free_tier())
}
/// Half the effective interval, capped at [`SUBSCRIPTION_CHECK_DEBOUNCE`]
/// — scaling keeps the debounce from swallowing watch ticks when the
/// cadence is tightened.
fn subscription_check_allowed(&self) -> bool {
let debounce = self
.subscription_watch_interval()
.map(|iv| (iv / 2).min(SUBSCRIPTION_CHECK_DEBOUNCE))
.unwrap_or(SUBSCRIPTION_CHECK_DEBOUNCE);
self.last_subscription_check_at
.is_none_or(|t| t.elapsed() >= debounce)
}
fn note_subscription_check(&mut self) {
self.last_subscription_check_at = Some(std::time::Instant::now());
}
/// Single guard-and-fire for the watch tick and the terminal-refocus
/// trigger. Empty when unwanted or debounced. The 5s paywall chain
/// deliberately bypasses this. `trigger` tags the unified-log entry
/// (`"watch"` / `"focus"`) so the check cadence is reconstructable
/// from logs.
#[must_use]
pub fn fire_subscription_check(&mut self, trigger: &'static str) -> Vec<Effect> {
if self.subscription_watch_wanted() && self.subscription_check_allowed() {
self.note_subscription_check();
crate::unified_log::info(
"subscription.check.fired",
None,
Some(serde_json::json!({
"trigger": trigger,
"interval_secs": self
.subscription_watch_interval()
.map(|iv| iv.as_secs()),
"gated": self.gate.is_some(),
"tier": self.subscription_tier,
})),
);
vec![Effect::CheckSubscription { verify: None }]
} else {
vec![]
}
}
/// Chokepoint for showing a gate. Already gated → update the copy.
/// Consumer session with access → defer for live verification (the gate
/// source may be stale). Otherwise → show directly.
#[must_use]
pub fn impose_gate(&mut self, gate: kigi_shell::auth::GateInfo) -> Vec<Effect> {
if self.gate.is_some() {
self.gate = Some(gate);
return vec![];
}
if self.is_consumer_session() {
return self.defer_gate_for_verification(gate);
}
crate::unified_log::info(
"subscription.gate.imposed",
None,
Some(serde_json::json!({ "deferred": false })),
);
self.gate = Some(gate);
vec![]
}
/// Chokepoint for a settings-confirmed gate lift. Clears the visible
/// gate and any pending deferral; when either existed, runs the lift
/// bookkeeping and returns the JWT-refresh check (the tier claim is
/// baked into the JWT, so the shell must re-mint it).
#[must_use]
pub fn lift_gate(&mut self) -> Vec<Effect> {
let was_blocked = self.gate.is_some() || self.pending_gate_verification.is_some();
self.gate = None;
self.pending_gate_verification = None;
if !was_blocked {
return vec![];
}
self.welcome_prompt_focused = true;
self.paywall_check_started = None;
crate::unified_log::info(
"subscription.gate.lifted",
None,
Some(serde_json::json!({ "tier": self.subscription_tier })),
);
vec![Effect::CheckSubscription { verify: None }]
}
/// Hold `gate` out of `self.gate` while a generation-stamped live check
/// verifies it. Resolution: authoritative meta via `apply_auth_meta`
/// (drops the deferral), or promotion on same-generation check failure /
/// timeout via [`Self::promote_deferred_gate`].
#[must_use]
fn defer_gate_for_verification(&mut self, gate: kigi_shell::auth::GateInfo) -> Vec<Effect> {
self.pending_gate_verification = Some(gate);
self.gate_verify_gen = self.gate_verify_gen.wrapping_add(1);
self.note_subscription_check();
crate::unified_log::info(
"subscription.gate.deferred",
None,
Some(serde_json::json!({
"generation": self.gate_verify_gen,
"tier": self.subscription_tier,
})),
);
vec![
Effect::CheckSubscription {
verify: Some(self.gate_verify_gen),
},
Effect::ScheduleGateVerifyTimeout {
generation: self.gate_verify_gen,
},
]
}
/// Show a deferred gate (err on blocking) — no-op unless `generation`
/// is the current verification and nothing resolved it meanwhile.
/// `reason` tags the unified-log entry (`"check_failed"` /
/// `"verify_timeout"`).
pub(crate) fn promote_deferred_gate(&mut self, generation: u64, reason: &'static str) {
if generation == self.gate_verify_gen
&& let Some(gate) = self.pending_gate_verification.take()
&& self.gate.is_none()
{
// Warn: the verification did not confirm access, so the user is
// now blocked. If this is wrong (paying user paywalled), this
// entry plus the preceding check.fired/check.complete lines
// show which path failed.
crate::unified_log::warn(
"subscription.gate.promoted",
None,
Some(serde_json::json!({
"generation": generation,
"reason": reason,
"tier": self.subscription_tier,
})),
);
self.gate = Some(gate);
}
}
}
#[cfg(test)]
mod tests {
use super::*;
use crate::app::app_view::tests::test_app;
fn watch_gate() -> kigi_shell::auth::GateInfo {
kigi_shell::auth::GateInfo {
message: "Subscribe".into(),
url: None,
label: None,
}
}
#[test]
fn may_be_free_tier_matrix() {
let mut app = test_app();
app.subscription_tier = None;
assert!(app.may_be_free_tier(), "unknown tier is potentially free");
app.subscription_tier = Some("Free".into());
assert!(app.may_be_free_tier());
app.subscription_tier = Some(" FREE ".into());
assert!(app.may_be_free_tier(), "case/whitespace-insensitive");
app.subscription_tier = Some("SuperGrok Heavy".into());
assert!(!app.may_be_free_tier());
app.subscription_tier = Some("X Premium".into());
assert!(!app.may_be_free_tier());
}
#[test]
fn subscription_watch_wanted_matrix() {
let mut app = test_app(); // AuthState::Done, consumer, tier unknown
assert!(
app.subscription_watch_wanted(),
"unknown-tier consumer session watches"
);
app.subscription_tier = Some("Free".into());
assert!(app.subscription_watch_wanted(), "free tier watches");
app.subscription_tier = Some("SuperGrok".into());
assert!(!app.subscription_watch_wanted(), "paid tier is dormant");
// Gated — watches regardless of the (stale) tier string.
app.gate = Some(watch_gate());
assert!(app.subscription_watch_wanted(), "gated session watches");
app.gate = None;
app.subscription_tier = Some("Free".into());
app.is_api_key_auth = true;
assert!(
!app.subscription_watch_wanted(),
"API-key auth never watches"
);
app.is_api_key_auth = false;
app.team_name = Some("Acme Corp".into());
assert!(
!app.subscription_watch_wanted(),
"team session never watches"
);
app.team_name = None;
app.auth_state = AuthState::Pending { error: None };
assert!(!app.subscription_watch_wanted(), "pre-auth never watches");
}
#[test]
fn subscription_watch_interval_override_clamp_and_disable() {
let mut app = test_app();
assert_eq!(
app.subscription_watch_interval(),
Some(SUBSCRIPTION_WATCH_INTERVAL)
);
app.subscription_watch_interval_secs = Some(120);
assert_eq!(
app.subscription_watch_interval(),
Some(std::time::Duration::from_secs(120))
);
app.subscription_watch_interval_secs = Some(1);
assert_eq!(
app.subscription_watch_interval(),
Some(std::time::Duration::from_secs(
SUBSCRIPTION_WATCH_MIN_INTERVAL_SECS
)),
"sub-floor values are clamped"
);
app.subscription_watch_interval_secs = Some(0);
assert_eq!(app.subscription_watch_interval(), None);
app.subscription_tier = Some("Free".into());
assert!(
!app.subscription_watch_wanted(),
"interval 0 must disable the watch even on the free tier"
);
}
#[test]
fn subscription_check_debounce() {
let mut app = test_app();
assert!(app.subscription_check_allowed(), "no prior check — allowed");
app.note_subscription_check();
assert!(
!app.subscription_check_allowed(),
"right after a check — debounced"
);
app.last_subscription_check_at =
Some(std::time::Instant::now() - SUBSCRIPTION_CHECK_DEBOUNCE);
assert!(app.subscription_check_allowed());
}
#[test]
fn fire_subscription_check_guards_and_debounces() {
let mut app = test_app();
let effs = app.fire_subscription_check("watch");
assert!(matches!(
effs.as_slice(),
[Effect::CheckSubscription { verify: None }]
));
assert!(
app.fire_subscription_check("watch").is_empty(),
"second fire inside the debounce window must be empty"
);
let mut paid = test_app();
paid.subscription_tier = Some("SuperGrok".into());
assert!(
paid.fire_subscription_check("watch").is_empty(),
"paid tier never fires"
);
}
#[test]
fn impose_gate_defers_for_consumer_session() {
let mut app = test_app();
let effs = app.impose_gate(watch_gate());
assert!(
app.has_access(),
"deferred gate must not render as a paywall"
);
assert!(app.pending_gate_verification.is_some());
assert!(
!app.subscription_check_allowed(),
"the deferral's own check counts for the debounce"
);
assert!(matches!(
effs.as_slice(),
[
Effect::CheckSubscription {
verify: Some(check_gen)
},
Effect::ScheduleGateVerifyTimeout {
generation: timeout_gen
}
] if *check_gen == app.gate_verify_gen && *timeout_gen == app.gate_verify_gen
));
}
#[test]
fn impose_gate_direct_for_non_consumer_and_already_gated() {
// Team session: no live verification possible — show directly.
let mut app = test_app();
app.team_name = Some("Acme Corp".into());
assert!(app.impose_gate(watch_gate()).is_empty());
assert!(!app.has_access());
assert!(app.pending_gate_verification.is_none());
// Already gated: update the copy only.
let mut gated = test_app();
gated.gate = Some(watch_gate());
let new_copy = kigi_shell::auth::GateInfo {
message: "New copy".into(),
url: None,
label: None,
};
assert!(gated.impose_gate(new_copy).is_empty());
assert_eq!(gated.gate.as_ref().unwrap().message, "New copy");
}
#[test]
fn impose_gate_bumps_generation_each_time() {
let mut app = test_app();
let _ = app.impose_gate(watch_gate());
let first = app.gate_verify_gen;
app.pending_gate_verification = None; // simulate resolution
let _ = app.impose_gate(watch_gate());
assert_eq!(app.gate_verify_gen, first + 1, "each deferral re-stamps");
}
#[test]
fn lift_gate_runs_bookkeeping_once() {
let mut app = test_app();
app.gate = Some(watch_gate());
app.paywall_check_started = Some(std::time::Instant::now());
let effs = app.lift_gate();
assert!(app.has_access());
assert!(app.welcome_prompt_focused);
assert!(app.paywall_check_started.is_none());
assert!(matches!(
effs.as_slice(),
[Effect::CheckSubscription { verify: None }]
));
assert!(
app.lift_gate().is_empty(),
"lift without a gate or deferral is a no-op"
);
}
#[test]
fn lift_gate_counts_pending_deferral_as_blocked() {
let mut app = test_app();
let _ = app.impose_gate(watch_gate());
let effs = app.lift_gate();
assert!(app.pending_gate_verification.is_none());
assert!(
matches!(
effs.as_slice(),
[Effect::CheckSubscription { verify: None }]
),
"a confirmed lift of a pending gate must still refresh the JWT"
);
}
#[test]
fn promote_deferred_gate_is_generation_scoped() {
let mut app = test_app();
let _ = app.impose_gate(watch_gate());
let stale_gen = app.gate_verify_gen;
let _ = app.impose_gate(watch_gate());
app.promote_deferred_gate(stale_gen, "verify_timeout");
assert!(
app.has_access(),
"stale generation must not promote the newer deferral"
);
app.promote_deferred_gate(app.gate_verify_gen, "verify_timeout");
assert!(!app.has_access(), "current generation promotes");
}
#[test]
fn apply_auth_meta_drops_pending_gate_verification() {
let mut app = test_app();
let _effs = app.impose_gate(watch_gate());
app.apply_auth_meta(&kigi_shell::auth::AuthMeta::default());
assert!(app.pending_gate_verification.is_none());
assert!(app.has_access());
}
}