Repository navigation
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 388b4f8f73
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a415af16f4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 23330d590a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 33a2358a02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1a5e3e05bf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dee3aa9af1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a44851e611
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 912f680930
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c334ab1d7f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 611e15787b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9463ad644d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 48b13524c0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ba300caeab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ejsmith
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6d8644f109
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ejsmith
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 00e2cd7571
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 88b1f43700
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
niemyjski
left a comment
niemyjski
left a comment
There was a problem hiding this comment.
The alias normalization and legacy membership fallback address the original alias and guessed-creator cases, and paid invitations now retain their previous behavior. Local revalidation still reproduced account-deletion trial renewal and both verification issues below.
Validation: 217 focused backend tests and 31 frontend tests passed; local staging-mode API and browser checks used Mailpit and a simulated Exie provider. Actual Stripe checkout and live AI were not exercised.
The existing mailbox-claim review finding is confirmed: start a trial, delete its organization and user, register the identical address again, and create an organization; the replacement receives EX_TRIAL again. Keep the claim independently of the deletable user record.
Other open feedback remains relevant: TrialExpirationJob still catches cancellation inside the batch and can page/renew afterward; the migration test does not check preservation of unrelated mappings/settings; and the invitation cache key remains constructed inline. Paid invite compatibility is fixed, but Free/trial invites still introduce 403/429 for formerly accepted requests, so the compatibility decision remains open while the PR says there are no breaking changes.
There was a problem hiding this comment.
Changes requested for two reproduced blockers:
- Account deletion resets the mailbox trial claim, allowing the same address to receive another trial. Preserve that claim independently of the deletable user record.
- Verification in another tab leaves the original Exie panel locked. Refresh the separate assistant-access query through the existing account-change path.
Before merge, explicitly decide whether the new Free/trial invite 403/429 responses are accepted compatibility changes and describe that decision accurately. The anti-abuse restrictions may be intentional; this is not a request to remove them.
Follow-up, not release blockers: misleading success text when another account's verification link is used, expiration-job cancellation handling, and bounded-memory billing statistics (downgraded to P3). No broad refactor is requested.
Verification: reviewed head 88b1f4370. On November 6, 35 focused backend tests, 31 frontend tests, and diff whitespace checks passed. Browser/API reproductions are from November 4 on that same head; E2E, Stripe checkout, and live AI were not rerun.
|
Addressed the review in bf287f7:
Replied on every thread. The ones that were questions (lock scope, 426, microdollars, Mailer, invite limit setting) are left open for you. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: daba9fb6d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
niemyjski
left a comment
niemyjski
left a comment
There was a problem hiding this comment.
The previous trial-abuse and cross-tab verification blockers are addressed. Local dogfood confirmed a 14-day trial, Exie unlocking in the original tab after following the Mailpit link elsewhere, and a completed chat through a simulated local provider. Deleting the project, organization, and account, then registering the identical address now yields Free; Gmail aliases and disposable domains also yield Free. Cross-account verification now names both accounts. The new invite 403/429 behavior is explicitly documented as intentional.
Found and fixed one regression in 7ab11cb: a stale cached expired trial could overwrite an extension. The expiration job again reloads authoritative state under its existing billing lock; one failing-before/passing-after regression test was added. No broader refactor.
Validation: 282 focused backend tests (including API snapshots) and 43 frontend tests passed. Hosted CI is running. No additional merge-blocking finding from this pass. The shared daily cap resetting on Redis eviction/restart remains the previously documented maintainer decision; real Stripe checkout and live AI were not exercised.
Superseded by the November 9 re-review and local verification: the account-deletion and cross-tab verification blockers are fixed, invite compatibility is explicitly documented, and the new expiration regression is fixed in 7ab11cb.
- Page through all organization members (user limits are gone, so members can exceed one page) - Record TrialReminderSentUtc only after every reminder is queued, so a queueing failure is retried on the next run instead of silently skipping the reminder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Downgrades to Free now take the same per-owner lock as organization creation, so two concurrent downgrades of one owner's paid organizations can't both pass the one-free-organization rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Migration 11 now copies BillingChangedByUserId into CreatedByUserId for existing organizations, so ownership always uses the immutable creator. This removes the membership-based fallback, which read the mutable billing audit field and changed owner whenever a member changed the plan. Sample data records the creator too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Admin plan changes preserve the billing price; applying EX_TRIAL reset it to zero, which a later admin change back to a paid plan didn't restore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The shared daily counter is updated after durable usage is recorded; if that cache update threw, the provider lifecycle treated the request as unreconciled and recorded the estimate again. Log and continue instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Moving a paying organization onto the no-card trial left its Stripe subscription running and then dropped it to Free when the trial ended, losing its price. The admin trial action is for starting or extending a trial, so restrict it to free and trial organizations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Admin plan changes now share the organization billing lock with user plan changes and the trial expiration job, and reload the organization inside it, so an admin extending a trial can't race the job ending it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Show the trial banner only in the last 3 days, dismissible until the next day, with a quiet days-left indicator in the sidebar. Replace the permanent Free banner with a one-time trial-ended notice recorded per user and organization. Add a dismissible warning at 80% of the monthly event limit, and send the trial reminder email 3 days before the trial ends. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Save the trial-ended dismissal to the cached user right away and reload it if the save fails, skip the notice while impersonating so admins don't fill their own product tour records, and re-check day and month dismissals each minute. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Check the shared daily total after reserving a provider request's estimate and reject requests that started at or past the limit, so a burst can exceed it by at most one estimate. Only reservations whose estimate was counted adjust the shared total later. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- One trial per mailbox: store the normalized email (lowercase, no +tag, no Gmail dots) that claimed a trial and check it under a per-mailbox lock. - Disposable email domains get Free instead of a trial. System admins edit the blocked list on the system settings page; the built-in list applies until they save their own. - Trials are only for users who belong to no organization and created none. - Migration 11 no longer guesses creators from the last billing change. Organizations without a recorded creator fall back to the membership rule. - Invite verification and the daily limit apply only to Free and trial organizations; paid organizations invite as before.
- Keep mailbox trial claims in a separate trial-claims index (hashed), so deleting and recreating an account doesn't renew the trial - Refresh Exie access in every tab when the signed-in user changes, and say which account a verification link verified - Stop the trial expiration job before the next organization when cancelled; read organizations from cache - Move the free invite counter and billing lock keys into BillingManager - Use BillingPlan.Unlimited, require TimeProvider in AssistantAccessService, and share one usage date helper - Accumulate billing plan stats page by page - Test that migration 11 keeps existing mappings and settings; add Arrange/Act/Assert to the PR's frontend tests
Persist mailbox claims before granting trials, reject unconfirmed shared cost reservations, patch only migrated organization limits, and refresh sidebar countdowns. Add regression coverage for failure recovery, usage reconciliation, concurrent writes, and elapsed time.
…oses Trial claims now block another trial for Billing:TrialClaimRetentionDays (365 by default). An expired claim is renewed when the mailbox starts a new trial, and the trial expiration job deletes expired claims. A user's own earlier trial follows the same window. The change plan dialog lists the retention, event limit, and premium features a downgrade gives up. It never blocks the downgrade. Drop three blocked domains that couldn't be confirmed as disposable, and test that major mailbox providers are never blocked.
1968dde to
b4ed058
Compare
|
niemyjski
left a comment
niemyjski
left a comment
There was a problem hiding this comment.
Re-reviewed the latest commit, 98185ea39. No remaining reproduced trial blockers.
Free is 1 user / 1 project. Expiry preserves data, suspends ingestion over capacity, and automatically recovers after excess members/invites/projects are removed. Finite/custom downgrade checks and admin trial-end controls are covered.
Validation: CI passed on this exact commit, including all backend and six browser shards and the flaky-test gate. Local browser expiry/recovery and 1,205 frontend tests passed. The full local backend run had five search-fixture startup failures; all five passed in isolation.
Replied to all 29 new comments and resolved 27. The two presentation-clock discussions remain follow-up review items; they make no API calls.
Deployment still requires the stable dedicated HMAC secret. Mailbox claims survive deletion for 365 days; the extra privacy document and undeployed conversion migration were removed.
Eligible first organizations get a 14-day trial with Medium features and Exie, without a card. Free remains one user and one project; trials and standard paid plans have unlimited capacity. Over-limit expiry suspends ingestion while preserving data and management access. Removing excess users, pending invitations, and projects automatically clears the plan-limit suspension.
Validation: latest CI passed, including all backend and six browser shards. Local focused tests, 1,205 frontend tests, API generation, and browser expiry/recovery passed. Five local search-fixture failures passed in isolation.
Deployment requires stable
EX_Billing__TrialClaimSecret: at least 32 random bytes, base64, shared by API/jobs. Claims survive deletion for 365 days. Migration 11 resets stored limits on known plans to their current defaults.Invite APIs retain capacity rejection 426; Free/trial abuse controls can return 403/429.
Verification and implementation details
update-organization-plansadmin maintenance reapplies plan defaults while preserving billing prices. Migration 11 overwrites known plans' stored user/project limits with their current defaults. It preserves unknown plan IDs, billing/usage fields, and concurrent plan changes; it does not guess creators from prior billing editors./api/v2/admin/change-planaccepts optionaltrialEndsUtc. Free/trial organizations expose Admin Actions → Set trial end date, including past dates for expiry testing. Paying subscriptions cannot be put on a trial.