fix(renderer): lift Desktop 26.1007 combined Codex usage gate

[zxd-666]

Summary

Desktop 26.1007 folds the Account rate-limit selector and the reserve active flag into one boolean selector. The Codex usage gate probe classified that merged selector as mixed and rejected the whole Composer owner, so external-Harness Composers fell back to unsupported and kept the native usage restriction: the send button stayed disabled whenever the Codex subscription quota was exhausted, even with an external Harness selected and its adapter ready.

This adds a combined gate kind:

• A selector is combined when it reads auth.authMethod + limit.allowed + reserve.active (the two verified gates' fields), reads no reserve.hardBlocked, and every field it reads belongs to the usage-domain whitelist. It is then projected to false exactly like the account and reserve gates.
• Any field outside the whitelist, or hardBlocked mixed in, still classifies as mixed → invalid → unsupported: unverifiable contracts keep native restrictions (fail-safe unchanged).
• The separate account selector (≤26.928) and combined (26.1007+) are two generations of the same gate; if both are ever seen together the owner is rejected.
• Contract audit gains combinedGateCount (renderer + desktop-control validator + tests).

Root cause evidence (live Desktop 26.1007, quota exhausted)

• Probe replica on the running app: the real Composer owner exposes a healthy reserve gate (reserve.hardBlocked, snapshot match OK) plus one selector reading auth.accountId, auth.accountLoading, auth.accountStructure, auth.authLoading, auth.authMethod, auth.authenticatedAccountId, auth.plan, auth.userId, limit.allowed, limit.primary_window, limit.secondary_window, reserve.active → classified mixed → invalid → owner rejected → unsupported.
• Before the fix: composer title tooltip “当前 Desktop 版本无法将此 Harness 与 Codex 额度限制分离…” and the send button disabled=true with hermes selected and adapter ready, quota banner visible.
• After deploying the new renderer bundle to the installed app (0.13.2 + ChatGPT.app 26.1007.71326): tooltip gone, and with text in the composer the send button is disabled=false while the quota banner (“Codex 和工作使用额度已用完”) is still displayed. Native Codex Composers keep the restriction.

Test plan

• npx vitest run --config tests/vitest.config.js packages/renderer-extension/test/renderer-codex-usage-gate.test.ts packages/desktop-control/test/contract-audit.test.ts — 20 passed. New cases: 26.1007 combined selector lifted for the external Composer only (shared store untouched, second Composer stays native, update(false) restores); combined selector reading a whitelist-external field stays unsupported; account + combined together rejected; audit counts.
• Full suite npx vitest run --config tests/vitest.config.js --exclude tests/release/release-version.test.mjs on this branch vs origin/main baseline: failed-file lists identical (49 pre-existing environment failures, e.g. optional SDK packages) — zero regressions from this change.
• npm run typecheck — only the 2 pre-existing host-runtime errors present on main (verified via checkout baseline).
• npx eslint on all touched files — clean. npx prettier --check . — clean.
• Live Desktop verification on the installed app (real machine, macOS, ChatGPT.app 26.1007.71326, quota genuinely exhausted): before → send disabled with gate-unavailable tooltip; after deploying this bundle → tooltip gone, send button enabled with a draft present, other Composers/native behavior unchanged.

Verified on commit 5a178f2.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: BytePioneer-AI/codex-host/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 58e5ffc4-0da5-4ab8-9d3b-680b6ca6b655

📥 Commits

Reviewing files that changed from the base of the PR and between 1aa9f65 and 5a178f2.

📒 Files selected for processing: 5

• packages/desktop-control/src/contract-audit.ts
• packages/desktop-control/test/contract-audit.test.ts
• packages/renderer-extension/src/contract-audit.ts
• packages/renderer-extension/src/renderer-codex-usage-gate.ts
• packages/renderer-extension/test/renderer-codex-usage-gate.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 4

• GitHub Check: Check windows-latest
• GitHub Check: Check ubuntu-22.04
• GitHub Check: Check macos-14
• GitHub Check: Check Linux ARM64

🔇 Additional comments: 1

packages/renderer-extension/src/renderer-codex-usage-gate.ts: 1

242-242: 🔒 Security & Privacy

trace 确实不会递归代理嵌套属性，但仓库没有证据表明 Desktop 26.1007 的实际 selector 读取了此类嵌套字段。现有 combined fixture 只读取 limit.allowed、auth.authMethod 和 reserve.active。因此，当前评论依赖未建立的外部 selector 行为，不能据此提出阻塞修复。

📝 Summary

Summary by CodeRabbit

• 功能更新
  • 现在可识别并统计新版合并用量限制，同时仅在检测到的字段符合预期时应用该限制。
  • 当合并限制与旧版 Account 限制同时出现时，或检测到未识别字段时，将拒绝应用该限制。
• 测试
  • 补充了新版合并限制、未知字段和重复限制场景的覆盖。

新增对合并用量 gate 的识别和检查计数。严格契约审计要求包含 combinedGateCount，并拒绝缺少该字段或包含额外字段的记录。

Changes: 合并用量 gate

Layer / File(s)	Summary
识别与验证合并 gate packages/renderer-extension/src/renderer-codex-usage-gate.ts, packages/renderer-extension/test/renderer-codex-usage-gate.test.ts	识别同时读取 Account 用量字段和 reserve.active 的合并 selector。仅当所有读取字段都在白名单内且未读取 reserve.hardBlocked 时，才将 selector 分类为 combined。同一 Composer 同时暴露 Account 与合并 gate 时，更新返回 unsupported。
审计计数与契约校验 packages/desktop-control/src/contract-audit.ts, packages/desktop-control/test/contract-audit.test.ts, packages/renderer-extension/src/contract-audit.ts, packages/renderer-extension/test/renderer-codex-usage-gate.test.ts	检查结果新增 combinedGateCount。聚合逻辑累加可编辑 composer 的合并 gate 数量；严格校验要求该字段为必需键，并拒绝额外键。

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: bytepioneer-ai

Merge Risk: ⚪ Minimal · up to 5a178

This change adds recognition of the Desktop 26.1007 combined usage gate and an audit count for it. Unknown fields and duplicate gates still keep the native restriction, so no concrete merge-blocking risk was found.

Pre-merge checks: 4

Check name	Status	Explanation
Description check		描述清楚说明了 Desktop 26.1007 的 combined gate 问题、修复范围、失败安全行为和测试结果，与变更内容直接相关。
Title check		标题准确概括了 renderer 中对 Desktop 26.1007 combined Codex usage gate 的修复，简洁且与主要变更一致。
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}