Port upstream 0.67.0: History window setting and period-aware spend surfaces (stacked on #648)

[Finesssee]

Summary

Stacked on #648 (CostReportingPeriod core and range-aware cost scanners). This PR wires the period into the desktop app:

• New persisted setting cost_reporting_period and a Settings > Usage & spend "History window" control: Month to date, All, 1 / 7 / 30 / 90 / 365 days, plus a custom day count in 1..=365. The old fixed 7d / 30d / All buttons are gone.
• Legacy behaviour is migrated: a missing or unreadable value becomes rolling:30; a legacy history_days of 0 means All.
• get_usage_spend_summary and get_spend_contract take an optional period (omitted means the saved setting). The period identity (month-to-date includes the month, so the key changes across a month boundary) is part of every cache key.
• UsageSpendRow.seven_day / thirty_day stay as fixed compatibility columns; new period_cost / period_tokens (and reporting_period on the summary, contract and local-usage summary) carry the selected window.
• Tray overview, menu card local usage block, float bar cost pill and the share PNG show the selected period label. Field names stay stable.
• Changing the setting clears the local usage cache and refreshes the float bar and tray.

Upstream reference

CodexBar 0.67.0, part C "reporting periods" (PR 3 of the 0.67.0 plan). Upstream is read-only reference; nothing was written upstream.

Ported / Deferred

Ported: everything listed in Summary, plus 16 en-US locale keys (Rust locale_keys!, en-US.ftl, keys.ts; other languages fall back to en-US).

Behaviour notes:

• Codex workspaces keep rolling days. Sidecar windows (Codex workspaces, OpenCodex imports, per-day history) use rolling days capped at 365: Month to date becomes days elapsed, All becomes 365.
• Chart bars stay 30 days.
• PowerToys thirty_day_cost / thirty_day_tokens stay the trailing 30 days regardless of the setting (documented in powertoys.rs). ProviderLocalUsageSummary.thirty_day_* is also fixed at 30 days.
• Provider-reported daily costs are bucketed by UTC. A provider-reported 30-day total with no daily data only answers a Rolling(30) selection.

Bedrock: the provider now also fetches Cost Explorer DAILY spend over the exposed range (current month plus 13 months, best-effort) into CostSnapshot.daily, so month to date and All are answered from it. The fixed 30-day column only sums the last 30 days of daily points.

Deferred: translations of the new keys (English fallback); removal of now-unused legacy locale keys such as UsageSpendAllTimeHistory.

Validation

Rust toolchain 1.98.0, run through the E-core wrappers, CARGO_BUILD_JOBS=5, --test-threads=4.

• cargo +1.98.0 fmt --all: clean
• cargo +1.98.0 clippy --workspace --all-targets -- -D warnings: clean
• cargo +1.98.0 test -p codexbar -- --test-threads=4: 2190 passed, 0 failed, 1 ignored (plus 1 passed in the second test target)
• cargo +1.98.0 test -p codexbar-desktop-tauri -- --test-threads=4: 466 passed, 1 failed. The failure is commands::tests::bootstrap_payload_exposes_every_provider_variant (catalog 79 vs 78 active providers). It reads the machine's real settings via get_bootstrap_state, which depends on the local config, and is in code this PR does not touch (this PR only adds one field to bridge.rs). It fails the same way run alone. Not verified against a clean base on this machine.
• New Rust tests: cache-key identity for the selected period, month-to-date identity changing across a month boundary, period cost following the window, local usage keeping thirty_day fixed, and settings validation (rolling:0 rejected, month-to-date applied).
• pnpm --dir apps/desktop-tauri exec vitest run: 69 files, 422 tests passed
• pnpm --dir apps/desktop-tauri run lint: 0 errors, 14 warnings (all in code this PR does not add, unchanged)
• pnpm --dir apps/desktop-tauri exec tsc --noEmit: clean
• pnpm --dir apps/desktop-tauri run build (includes check-locale-drift): built
• No touched file crossed 1000 lines; the new tray overview test lives in TrayPanel.period.test.tsx because TrayPanel.test.tsx was at 999 lines.

Affected areas

rust/src/cost_reporting_period.rs, rust/src/spend_contract*, rust/src/locale*; Tauri commands settings, bridge, usage_spend, chart, spend_contract, powertoys; frontend costPeriod, CostPeriodControl, UsageSpendTab, MenuCardDetails, TrayPanel, FloatBar, usageSpendSharing, bridge.ts, tauri.ts, keys.ts.

UI proof

Pending: coordinator will capture CUA proof on a fresh build.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: daf0722f-a441-498e-ada1-120e7ea3b673

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Port gap follow-up

Added: Bedrock now fetches Cost Explorer DAILY spend (current UTC month plus 13 months, via daily_range, paginated with a repeated-token guard, Bedrock service groups with positive amounts only, same day summed across pages) into CostSnapshot.daily. The fetch is best-effort, so the monthly figure is unaffected if it fails. Month to date and All in Usage & Spend now resolve from it. The fixed 30-day column now only sums the last 30 days of daily points so a long daily history cannot widen it. Bedrock date helpers moved to providers/bedrock/daily.rs. Tests: daily_costs_*, long_provider_daily_history_does_not_widen_the_fixed_columns.

Still left out:

• Pinned cost time zone setting: upstream-only surface, local scanners keep the local zone.
• serve /cost cache, totals.provenance/coverage/incompleteRequestCount: no local equivalent (Port upstream 0.67.0: cost --period and period-aware serve /cost (stacked on #648) #653).
• cachedTokens vs cacheReadTokens: intentional, local Claude count includes cache creation.
• Codex workspaces, sidecars and chart bars stay rolling/30 days: upstream 0.67.0 did not change the workspace sidecar either.
• Locale keys remain en-US only; CUA proof still pending.

[Finesssee]

Thermo-nuclear review

Reviewed the diff against the "cost-period-desktop" spec (settings control, Usage & Spend, tray/menu, float bar, share PNG, PowerToys kept at 30 days, workspaces rolling). Behavior matches the spec and no file crosses 1k lines because of this PR (bridge.rs was already over). The structure has these problems:

1. Compat fallbacks for a payload that cannot exist. Backend and UI ship in one binary, and reportingPeriod is a non-optional Rust String, yet reportingPeriod/periodCost/periodTokens are optional in bridge.ts. That spawns the same "no period, fall back to 30d" branch in MenuCardDetails, FloatBar (windowCost), TrayPanel (spendOf/title), usageSpendShareColumns(periodLabel?) (three withPeriod conditionals), and contractPeriodLabel (periodFromLegacyDays). The "older cache entries" comment is wrong (the cache is in-memory). Make the fields required and delete every fallback branch, plus periodFromLegacyDays.
2. Dead legacy parameter. get_usage_spend_summary and get_spend_contract still take history_days and resolve_request has a legacy arm (0 = All), but no caller passes it and the old 7/30/All selection was never persisted, so there is nothing to migrate. Drop the parameter and the arm; resolve_request becomes explicit-or-saved.
3. Copy-pasted selection block. build_usage_spend_summary repeats match period { Rolling(7) => seven.clone(), Rolling(30) => thirty.clone(), _ => scan } three times (Codex, Claude, Pi). Extract one helper.
4. Cache identity race (chart.rs). store_local_usage_summary recomputes the period identity from Settings::load() at store time. A scan that started under period A and finishes after the user picked B is stored as B's data and served for the TTL. The entry must be keyed by the period the summary was built for (summary.reporting_period).
5. Custom-days input persists on every valid keystroke. Typing "365" saves settings and rescans for 3, 36 and 365 days (each also clears the local usage cache and notifies float bar/tray). Commit on blur/Enter instead.
6. Dead locale keys. UsageSpendAllTime and UsageSpendAllTimeHistory lost their last users in this PR; remove them from en-US.ftl, locale.rs, keys.ts.
7. Bedrock utc_month_start spells CostTimeZone::Named(chrono_tz::UTC) even though this PR adds CostTimeZone::UTC for exactly this.

Noted, not changing: the extra Cost Explorer DAILY request per Bedrock refresh matches upstream (each paginated Cost Explorer request is billed by AWS; deriving the monthly figure from the daily pages would halve it but changes the failure semantics, so it needs a decision); Settings::load() is called several times per request, which is the existing pattern here.

[Finesssee]

Thermo-nuclear review follow-up (fixes at 29b34cc)

Reviewed by Codex gpt-6-luna (xhigh); verified and validated by Claude.

Fixed (all 7 findings):

1. reportingPeriod/periodCost/periodTokens are now required in bridge.ts; the 30d fallback branches in MenuCardDetails, FloatBar, TrayPanel, usageSpendShareColumns and contractPeriodLabel (periodFromLegacyDays) are removed.
2. Legacy history_days parameter and resolve_request legacy arm dropped; requests resolve from an explicit period or the saved setting.
3. Repeated Rolling(7)/Rolling(30)/scan selection extracted into one helper (with a unit test).
4. chart.rs cache is keyed by summary.reporting_period, not by settings re-read at store time (with a test).
5. Custom-days input commits on blur/Enter instead of every keystroke (tests added).
6. Dead locale keys UsageSpendAllTime/UsageSpendAllTimeHistory removed from all catalogs, locale.rs, keys.ts.
7. Bedrock utc_month_start uses CostTimeZone::UTC.

Left as-is: the extra Cost Explorer DAILY request per Bedrock refresh (needs a decision), repeated Settings::load() (existing pattern).

Commands run: cargo +1.98.0 fmt --all --check, clippy --workspace --all-targets -D warnings (clean), cargo test -p codexbar-desktop-tauri (469 pass, 1 unrelated failure: bootstrap_payload_exposes_every_provider_variant catalog count 79 vs 78, not touched by this PR), focused codexbar tests, tsc --noEmit (clean), full vitest (all pass after adjusting the share-row redaction test regex, which had matched periodTokens). CUA proof still pending.

[Finesssee]

CUA proof

Build commit: 29b34cc1f4d98d918c52724655982fc5c546a433 (PR head). Debug build via pnpm run tauri:build:debug, target dir proof-1.

Proof-only patch (never committed, restored after the build): root Cargo.toml [patch.crates-io] dirs = { path = ".../proof-shim/dirs" }, which redirects home/config/data/cache under CODEXBAR_PROOF_HOME. No source patches, no mocks, no network. Data is synthetic Codex session logs (gpt-5 input tokens at 0d/3d/20d/60d/200d: 1M/2M/3M/4M/5M) read by the real local scanner, plus the standard CODEXBAR_SEED_USAGE_JSON Codex snapshot.

Commands: launch.sh (settings:usageSpend, then trayPanel), driven with cua-driver call get_window_state / set_value / click (background only, window on the second monitor, no focus or input taken).

#	Assertion	Result
0	No real email/account visible (only seeded "Codex")	PASS
1	Dark theme stays dark under auto (settings and tray windows)	PASS
2	Usage & Spend shows "History window" control; old fixed buttons gone; default Last 30 days	PASS
3	7d: $3.75 / 3.00M tok; 30d: $7.50 / 6.00M; 65d custom: $12.50 / 10.00M; All: $18.75 / 15.00M; fixed 7-day and 30-day columns unchanged ($3.75, $7.50)	PASS (matches fixture ratios)
4	Month to date selectable, label "Month to date", $7.50 (matches Sep 2026 sessions)	PASS
5	Custom days accepts 65 ("Custom days (1-365)" spinner, "Last 65 days"); stored value 0 falls back to Last 30 days	PASS. Values above 365 were not exercised.
6	home\AppData\Roaming\CodexBar\settings.json has "cost_reporting_period":"rolling:7" after last selection; real %APPDATA%\CodexBar\settings.json untouched (mtime Jun 5)	PASS
7	Tray overview shows selected period: "Usage & Spend · 7d $3.75"	PASS

Screenshots (local, not committed): %LOCALAPPDATA%\Win-CodexBar\port-audit\proof\665\shots\ (s04-30d-baseline, s05-7d, s06-mtd, s08-all, s09-custom65, s12-rolling0, s13-tray-7d, each with a .txt UIA dump). Plan: ...\proof\665\PLAN.md.

[Finesssee]

Lane validation 2026-10-01 (worktree W:/wcb-wt/lane-b, local rustc 1.96, CARGO_TARGET_DIR=W:\cargo-target\lane-b, E-core gate):

• cargo fmt --all --check: clean
• cargo test --workspace: codexbar suites pass; codexbar-desktop-tauri 469 passed / 1 failed — the failure is commands::tests::bootstrap_payload_exposes_every_provider_variant (catalog 79 vs 78), the known Isolate bootstrap payload test from real settings #684 host-settings baseline (the test reads the machine settings via get_bootstrap_state; hermetic fix Make the bootstrap catalog test hermetic (#684) #711 lives on release/v0.70.0, not in this stack). Not touched by this PR's diff.
• Re-verified the existing browser-use proof artifacts at port-audit/proof/665 (PLAN.md, s01-s13 UIA dumps): History window control present with presets MTD/1/7/30/90/365/All plus custom 1..=365; custom 65 accepted; stored rolling:0 falls back to Last 30 days; tray shows "Usage & Spend · 7d"; settings persisted under the isolated PROOF_HOME only.
• Clippy -D warnings: the 3 pre-existing main-history findings (alibabatokenplan/cli.rs:163, kiro/usage_limits.rs:315, openai/subscription.rs:206) are outside this PR's diff and recorded in QUEUE.md INTEGRATION FINDINGS; no new findings in this PR's files.

No code changes needed at head 29b34cc; branch is up to date with origin. Awaiting merge order (stacked on #648).

[Finesssee]

Adversarial validation passed at a453cfd

Scope: History window setting and period-aware spend surfaces (#665, upstream 0.67.0), validated as merged into release/v0.70.0 (merge a453cfd = merge of 29b34cc into 4988b27... per the audit the desktop row cites merge a453cfd on the 648 branch).

Attacks (highest-risk semantics, from the merged tree):

• Settings key round-trip: the history-window setting is written and read through the same CostReportingPeriod core as the CLI/serve path (Port upstream 0.67.0: add CostReportingPeriod core and range-aware cost scanners #648/Port upstream 0.67.0: cost --period and period-aware serve /cost (stacked on #648) #653), so the desktop picker cannot set a value the CLI misreads; the settings tests cover the raw string round-trip.
• Period-aware surfaces use the resolved period, not a re-derived one: the UsageSpend surfaces consume the resolved period (start/end + identity) so the chart header and the served/CLI payloads agree; the integration kept the HEAD lower-bound fields and added period_cost/period_tokens, with the antigravity period scan preserved at merge.
• Locale keys: the integration dropped two invented keys and kept the HEAD key set — the locale.rs/keys.ts seam was resolved toward HEAD, so no phantom key is referenced by the UI.
• MenuCard/TrayPanel tests: the merge-seam conflict was fixed in 749f3a7 (batch-2 conflict fix commit), so the desktop tests carry both the HEAD trays and the new period fields without duplication.
• UI proof: the audit row cites a CUA proof (A0-A7 PASS at 29b34cc) covering the History window picker and period-aware surfaces — the Windows UI is the primary user surface here and it was proven on a real build.

No defects found. READY for the un-draft rule.

[Finesssee]

Shipped in v0.70.0: this PR's head is included in main via #735 (merge commit 9d0a37a). Closing as integrated.