Port upstream 0.60.4: keep Chrome DeepSeek balance through same-session transport failures (stacked on #646)

[Finesssee]

Summary

Ports the behavior of upstream CodexBar 0.60.4 "keep Chrome DeepSeek balances visible through temporary connection failures for the same browser session, preserving the original measurement time".

When no DeepSeek API key is configured, Auto mode now reads the Platform balance through a signed-in Chrome session (token read with the LevelDB reader from #646). If a later refresh fails with a transport failure (timeout or connection refused), the cached balance stays visible with its original updated_at, but only when the failed request used the same Chrome profile and the same token that produced the cached balance. A rejected session, a different profile or token, a resolution deadline, or a balance with no session owner (for example an API-key balance) is never retained; the error is shown instead.

Found by the 0.60.4-0.69.0 port gap audit.

Upstream reference

• steipete/CodexBar PR fix(deepseek): retain balances only for matching live sessions steipete/CodexBar#3680 "fix(deepseek): retain balances only for matching live sessions" (tag v0.60.4, head 82bfae5). Read-only, pinned to the tag.
• Upstream ownership is a profile id plus a namespaced SHA-256 digest of the trimmed token, held in memory only. This port mirrors that: LastGoodOwner (rust/src/core/last_good_owner.rs), never serialized, Debug redacted.
• Platform endpoint and auth-failure codes match upstream: GET https://platform.deepseek.com/api/v0/users/get_user_summary (Bearer, x-client-platform: web), 401/403 or envelope code/biz_code 40002/40003 mean the session is rejected.

Ported / Deferred

Ported:

• Owner-checked retention: ProviderError::OwnedTransport wraps only transport failures; the shell (commands/providers.rs) records the owner of each fresh snapshot in AppState.last_good_owners and keeps the cached snapshot only when the failure's owner matches.
• Fail-closed cases: resolution deadline (owner none), rejected session, unowned cached balance, unattributed transport failure for DeepSeek.
• Platform balance parsing (wallets summed per currency; funded USD, then any funded, then USD, then first).
• Chrome session import per profile (chrome:<dir> ids), 30-minute validation cache holding digests only, selected-profile balance always fetched live.
• Other providers keep their existing last-good policy.

Deferred (not in this PR):

• Profile picker UI. Until then, with several signed-in Chrome profiles the profile is chosen with env CODEXBAR_DEEPSEEK_PROFILE_ID (for example chrome:Profile 1); without it the user is told to set it.
• DEEPSEEK_PLATFORM_TOKEN and other manual-token env support.
• Detailed usage and cost rows for the Chrome lane (balance only here).
• Background catalog validation of all profiles.
• API-key balance with browser enrichment (upstream never lets it establish ownership; this port does not attempt it).
• Chrome Local State profile display names (labels use the directory name).
• Cancellation and stale-generation guards beyond what the shell refresh engine already does.

Validation

All with toolchain 1.98.0, slot-3 target dir, --test-threads=4.

• cargo fmt --all: clean.
• cargo clippy --workspace --all-targets -- -D warnings: pass.
• cargo test -p codexbar deepseek: 42 passed, 0 failed.
• cargo test -p codexbar (full): 2223 passed, 0 failed, 1 ignored.
• cargo test -p codexbar-desktop-tauri last_good: 9 passed.
• cargo test -p codexbar-desktop-tauri (full): 468 passed, 1 failed. The failure is the known bootstrap_payload_exposes_every_provider_variant (fixed by Isolate bootstrap payload test from real settings #684), unrelated.
• No frontend files touched, so no vitest/lint/build run.

Affected areas

• rust/src/core/ (owner type, ProviderError variant, ProviderFetchResult.last_good_owner)
• rust/src/providers/deepseek/ (Chrome session lane, platform balance, resolver)
• rust/src/cli/ (exhaustive ProviderError matches)
• apps/desktop-tauri/src-tauri/src/ (state.rs, commands/providers.rs retention path)

No new dependencies (sha2 and futures already in rust/Cargo.toml). No secrets logged; only profile ids go to tracing::debug.

Stacked on #646 (base port/micro-0.66.0-browser-leveldb-reader).

UI proof

Pending: coordinator will capture CUA proof on a fresh build.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Adversarial validation (lane-A) at 823e091 — restack onto the fresh #646 head

Restack result: the branch was previously built on the old #646 commit 4393cd43; it now sits on the current #646 head chain (347faabf, which carries the #620 build_fetch_context fixes and the 0.66 leveldb/browser-stack work) via merge 823e091a. One conflict (commands/mod.rs test-module registration: last_good_owner_tests + session_cookie_scope_tests) resolved by keeping both. No rebase performed — fast-forward push only.

Review verdict: the branch matches the audit-0.60.4 Gap-1 spec: DeepSeek gains a Chrome platform.deepseek.com userToken session lane (session_resolver.rs, +311 lines) that reads the token from Chrome Local Storage for the origin (unwrapping value/token/access_token/accessToken/userToken), validates candidates against the platform API, and keeps the last-good Chrome balance visible through same-session transport failures while preserving the original time (retention hook + owner-aware last-good policy, last_good_owner_tests.rs). Tests: session_resolver_tests.rs (+366) and deepseek/tests.rs (+31).

Checks at 823e091 (CARGO_TARGET_DIR=W:\cargo-target\lane-a, jobs=4, RUST_TEST_THREADS=4, run in the branch's own worktree D:\code\Win-CodexBar\.claude\worktrees\wf_67ee1e3f-692-3):

• cargo fmt --all --check: pass.
• cargo clippy both manifests --all-targets -- -D warnings: only the 3 documented pre-existing main-drift findings; 0 in this PR's diff.
• cargo test rust manifest: 2349 passed / 0 failed / 1 ignored (deepseek focused: 42/0).
• cargo test desktop manifest: 496 passed / 1 failed — bootstrap_payload_exposes_every_provider_variant, the documented Isolate bootstrap payload test from real settings #684 environment-dependent baseline on branches without Make the bootstrap catalog test hermetic (#684) #711 (expected; hermetic fix lives on release/v0.70.0).

Fast-forward pushed fe4cbc7b..823e091a (ls-remote verified).

[Finesssee]

Shipped in v0.70.0: this PR's head is included in main via #735 (merge commit 9d0a37a). Closing as integrated.