fix(claude): bound picker catalog row expansion

[luvs01]

Summary

• Bound Claude CLI and Desktop picker catalog rewrites before deep-cloning template metadata or serializing the response. Retained keys/fields and rows have individual limits, and all target surfaces share one cumulative row/byte budget and the existing 16 MiB output ceiling.
• Stage additions until the whole rewrite fits, preserving the exact upstream response on refusal. The CLI bootstrap fallback uses the same limits. Ordinary nested capabilities/thinking metadata, native rows, context windows, descriptions, and non-target surfaces retain their existing behavior.
• Extend the existing offline regression suites and document the current shared contract. This is a focused follow-up to the picker implementations in feat(claude): list opencodex models in the Claude Code CLI first-party /model picker #6418 and feat(claude): gateway by default, first-party risk warning, and Desktop picker mode #5728; fix(claude): rebuild a CLI picker snapshot whose rows no longer decode #6419 fixes snapshot freshness, a separate path.

Verification

All commands ran with Bun 1.4.0 in an isolated Linux cloud worktree based on 10428d0120cbceeff997508a28a7a50c4007f7dc.

• Red/green: seven focused new regression cases failed on the unchanged base and passed after the fix. They cover retained-field and whole-row limits, cumulative growth across both Desktop surfaces and duplicate surfaces, output limits in both catalog shapes, atomic refusal, and unchanged CLI response bytes/headers.
• bun test tests/claude-integration/claude-picker-bootstrap.test.ts tests/claude-integration/claude-cli-picker.test.ts — 40 pass, 0 fail, 227 assertions. Additional controls cover small independently cloned nested metadata, discarded presentation fields, UTF-8/JSON escaping, duplicate CLI surfaces, and fallback atomicity.
• bun run typecheck — passed.
• bun run structure:check — passed.
• bun run privacy:scan — passed.
• bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts — 27 pass, 0 fail, 638 assertions.
• git diff --check — passed.
• The import-derived changed suite and full suite were not run: concurrent worktrees share this cloud executor, and local validation was deliberately limited to audited offline files. The picker integration fixtures redirect provider requests to loopback Bun servers; no live provider, real credential, Desktop application, or deployment was used. Broader platform/full-suite coverage remains for exact-head CI.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. A fresh independent read-only review found no concrete bypass or compatibility regression; maintainer security review remains required before merge.

Exact-head review evidence

Cross-platform CI completed successfully for 09c8e78bde207f3d30ee12dee52bd9e3f997fc1c. The branch is one commit behind current dev, within the repository's readiness tolerance; that upstream change affects Windows service recovery, outside this diff. The focused local validation and documented full-suite exception above remain accurate. No open Codex/CodeRabbit review threads were present at attestation. CodeRabbit's previous green Draft status was a review skip; substantive review is now requested, and maintainer security review remains required before merge.

Summary by CodeRabbit

• Bug Fixes
  • Picker catalogs no longer add duplicate model options.
  • When a catalog update would exceed supported size limits, the update is skipped and the existing response is left unchanged.
  • Oversized picker data is rejected without partially changing existing options or metadata.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (2)

src/AGENTS.md — auto-discovered
structure/AGENTS.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3c955eba-5a96-4869-8b28-95d3c3c8acf2

📥 Commits

Reviewing files that changed from the base of the PR and between 10428d0 and 09c8e78.

📒 Files selected for processing (7)

• src/claude/intercept/cli-catalog.ts
• src/claude/intercept/picker-bootstrap.ts
• src/claude/intercept/picker-budget.ts
• structure/clients/claude-desktop.md
• structure/runtime.md
• tests/claude-integration/claude-cli-picker.test.ts
• tests/claude-integration/claude-picker-bootstrap.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Claude picker bootstrap and CLI catalog rewrites now share size and row budgets. Bootstrap injection plans additions before cloning or mutation, and both rewrite paths reject oversized output. Regression tests and documentation cover the limits and refusal behavior.

Changes

Picker rewrite bounds

Layer / File(s)	Summary
Shared budget and bootstrap injection src/claude/intercept/picker-budget.ts, src/claude/intercept/picker-bootstrap.ts, tests/claude-integration/claude-picker-bootstrap.test.ts	The shared budget limits total output to 16 MiB, added bytes to 2 MiB, added rows to 4,096, fields to 64 KiB, and rows to 256 KiB. Bootstrap injection plans additions across target surfaces before cloning or appending rows, and rejects oversized serialized output. Tests cover limits, cloning, and unchanged model lists when injection is refused.
CLI catalog rewrite bounds src/claude/intercept/cli-catalog.ts, tests/claude-integration/claude-cli-picker.test.ts, structure/runtime.md, structure/clients/claude-desktop.md	CLI catalog additions use the shared budget and do not mutate options when reservations fail. Catalog rewriting rejects oversized input and serialized output. Tests cover unchanged responses, size limits, and fallback injection; documentation describes the shared bounds and refusal behavior.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 09c8e

The picker rewrite bounds are ready to merge after normal checks; no unresolved issue was identified in the reviewed changes.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 09c8e

The change limits resource growth and prevents partial catalog updates when a rewrite cannot fit. No new authority or broader request reachability was identified in the inspected paths; deployment-specific exposure remains uncertain.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The inspected exposure is upstream catalog content reaching parsing, sizing, cloning, and serialization in the interception process. The changed exports do not themselves create a network handler or introduce a credential, persistent-data, or privileged-action sink. Resource exhaustion within that process is the relevant containment concern.

Trust Boundaries and Controls

• observed — Bootstrap decoding is bounded before parsing, and both body rewrite paths check output size. These controls constrain local transformation work; preserving the upstream response on refusal does not authenticate or sanitize that response.

Resilience and Maintainability Implications

• inferred — For production JSON-derived inputs, synchronous request-local planning and clone-before-append ordering contain budget and clone failures without exposing earlier surfaces' additions. There is no persistent rewrite transition to recover after interruption, and separate requests own separate parsed bodies and budgets.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding bounds to Claude picker catalog row expansion. It matches the PR objectives and affected implementation files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Superseded by the integration in #6487, with reviewed follow-up fixes in #6490 and Windows validation repairs in #6494/#6495, all merged into dev.

Picker catalog expansion budgets and atomic admission-before-mutation behavior were carried.

Original carry commit: f5483034009781f5492c884b37bd39b48c38de6d. Attribution to @luvs01 is preserved in the integration history and merge trailers. The final integrated candidate passed the complete cross-platform CI run.

Closing this PR as superseded, not claiming that its original head was merged. Thank you for the contribution.