Skip to content

feat(webapp): enforce watch plan limits - #4556

Merged
kathiekiwi merged 34 commits into
feat/agent-message-quota-tri-12863from
feat/agent-watch-limits-tri-12863
Aug 12, 2026
Merged

feat(webapp): enforce watch plan limits#4556
kathiekiwi merged 34 commits into
feat/agent-message-quota-tri-12863from
feat/agent-watch-limits-tri-12863

Conversation

@kathiekiwi

Copy link
Copy Markdown
Collaborator

What & why. Watches now honour a plan's watch limits. A watch whose window exceeds the plan's agentWatchMaxHours, or that would push the org past its agentWatchers count, is refused with a new watch_limit_reached result and an upgrade hint (a chat line on the card, HTTP 409 on the API).

Key decisions.

  • Plan limits are a floor below the existing code ceilings: min(plan, WATCH_MAX_HOURS=24) for the window, and the per-chat cap of 3 still applies independently. Plans only tighten, never loosen.
  • Watcher count is org-wide and checked only after the immediate check declines, so a one-shot consumes no slot.
  • Fails open: an absent limit resolves to the unlimited sentinel, so self-hosted is unaffected; the upgrade nudge is gated on isBillingConfigured().
  • Follow-up: quiet Pro-mark on the card's long-window options.

TRI-12863

Refuse a watch whose window exceeds the plan's agentWatchMaxHours, or that
would push the org past its agentWatchers count, with a new watch_limit_reached
result carrying an upgrade hint. Plan limits are a floor below the existing
code ceilings (min(plan, WATCH_MAX_HOURS=24) and the per-chat cap of 3, which
still apply independently). Fails open: an absent limit resolves to unlimited,
so self-hosted is unaffected and the upgrade nudge is gated on billing presence.

TRI-12863
@changeset-bot

changeset-bot Bot commented Aug 10, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 500ba80

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0cd3a47e-67a7-4a06-8429-f0c725a7cfb5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

The pull request adds plan-based limits for dashboard agent watches. It limits watch duration and organization-wide active watches, adds billing-aware refusal messages, and maps limit refusals to HTTP 409. It also adds sweep-attempt persistence for stale investigations. Failed settlements are retried up to five times before force abandonment as inconclusive. Integration tests cover both watch-limit enforcement and poison-investigation handling.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the change and key decisions but omits the required checklist, testing, changelog, and screenshots sections. Add the template sections, complete the checklist, document test steps, provide a changelog entry, and state whether screenshots are applicable.
Docstring Coverage ⚠️ Warning Docstring coverage is 27.27% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: enforcing watch plan limits.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 2
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/agent-watch-limits-tri-12863

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

@pkg-pr-new

pkg-pr-new Bot commented Aug 10, 2026

Copy link
Copy Markdown

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@d4bda0a

trigger.dev

npm i https://pkg.pr.new/trigger.dev@d4bda0a

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@d4bda0a

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@d4bda0a

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@d4bda0a

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@d4bda0a

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@d4bda0a

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@d4bda0a

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@d4bda0a

commit: d4bda0a

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

coderabbitai[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

@kathiekiwi
kathiekiwi merged commit e449743 into feat/agent-message-quota-tri-12863 Aug 12, 2026
26 of 31 checks passed
@kathiekiwi
kathiekiwi deleted the feat/agent-watch-limits-tri-12863 branch August 12, 2026 08:27
kathiekiwi added a commit that referenced this pull request Aug 12, 2026
… — and fixes (#4516)

Plan enforcement for the dashboard agent — message quota and watch
limits — plus the component gallery, fixes and test hardening from the
same stack (#4548, #4549, #4550, #4552, #4556 merged here).

## Plan enforcement
([TRI-12863](https://linear.app/triggerdotdev/issue/TRI-12863))

**Agent message quota.** The Free-plan allowance becomes a real
server-side limit with a durable counter. New `agent_message_usage`
table keyed `(organization_id, period)` — deliberately not joined to
chats, so deleting a chat can't free quota within the period. Both send
paths count one user message (wakes never count) and refuse at the cap
with `403 message_quota_reached`, which the client renders as an upgrade
panel, never a silent drop. The refusal code is a single shared constant
on both sides.

**Watch limits.** A watch whose window exceeds the plan's
`agentWatchMaxHours`, or that would push the org past its
`agentWatchers` count, is refused with `watch_limit_reached` (409 on the
API, an upgrade hint on the card). Plan limits only tighten the existing
code ceilings (`min(plan, 24h)`, per-chat cap of 3 still applies). A
plan limit of zero means zero, not unlimited. Questions answerable
instantly are answered before any plan refusal — a one-shot consumes no
slot and never sees an upgrade nag.

**Fails open by design.** Cloud ships the actual per-plan numbers
separately (TRI-12863 P0). Until then absent limits resolve to the
unlimited sentinel and the upgrade UI is gated on billing presence —
self-hosted sees no cap, no upsell, with tests proving the fallback.
Both quotas are nudges, not security boundaries: a failing limit read
never blocks a send.

## Component gallery

An admin-only gallery of every agent card state: five
`storybook.agent-*` pages (chat UI, view blocks, report, investigation,
watch) with their shared shell and manifest, demo fixtures, two
demo-only cards, toast examples, and the screenshot script. No LLM and
no data — every state renders from fixtures under
`dashboard-agent/demo/`, never reachable from a production path.
Designers and reviewers can look at every state, including the report
states, without seeding anything.

## And fixes

**SDK: watch-mode chat subscriptions survive quiet windows** (TRI-13065,
TRI-13070) — watch mode keeps reconnecting across empty long-poll
windows and only stops on abort or a settled session; a passive
subscriber can no longer stop a turn it doesn't own (`stopOnAbort` is
explicit, default off). Review findings fixed alongside: a superseded
stream's async teardown no longer removes the live successor's abort
controller or multi-tab claim, and stopping a generation hands the chat
back to the user's other tabs.

**Query boundary pinned end-to-end**
([TRI-11165](https://linear.app/triggerdotdev/issue/TRI-11165)) — a
route-level test drives `api.v1.query` with a real signed environment
JWT (writes refused before ClickHouse, a read passes); `readonly=1` made
non-overridable; a per-turn cap stops the model burning a turn rewriting
a query it can't fix (deterministic SQL errors only — busy/transport
rejections don't count).

**chat.agent durability regression suite**
([TRI-11166](https://linear.app/triggerdotdev/issue/TRI-11166)) —
testcontainers-backed coverage of the two audit criticals (cross-tenant
isolation, no duplicate mid-stream turn, both control-broken) plus
crash-resume, cursor-based refresh, clean rollback of a mid-write turn
failure (torn by a real constraint violation), and OOM-restart replay.

**Investigation sweep backoff** — stale investigations get an attempt
counter and backoff so a poison row can't pin the sweep queue head
(migration `0005`: `sweep_attempts`, `last_sweep_attempt_at`).

## Screenshots

<img width="1440" height="791" alt="Screenshot 2026-08-06 at 00 36 19"
src="https://github.com/user-attachments/assets/6a68cd42-8580-469d-afe7-e28d1eef18e1"
/>

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant