Repository navigation
Show shared usage and isolate browser session limits - #6
Merged
ancsingabor merged 5 commits intoOct 28, 2026
Merged
Conversation
ancsingabor
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Users can inspect shared execution capacity before submitting commands, and browsers behind one public IP no longer share the restrictive normal session-creation allowance.
A compact disclosure shows occupied slots and approximate daily allowance, with consumption, reservations, anonymous recent-browser activity and a local-time reset countdown. Aggregate-only usage and same-origin activity endpoints preserve ownership, revision, lease and reconciliation protections. Stale/unavailable metrics remain advisory.
Session creation allows 30/hour per signed browser owner, with a broader 120/hour/IP safeguard. Both buckets are checked atomically, so browser-limit rejections do not consume the network allowance. Cookie rotation still encounters the IP cap. Rate-limit responses identify the action and browser/network scope, return Redis-TTL-based Retry-After/retryAfter/retryAt, and display the retry time locally in the terminal/example runner. Command and general API limits remain unchanged.
Validation: all 33 server tests pass with isolated local Redis. Chromium acceptance passes shared usage, keyboard disclosure, multiple tabs, idle activity, reservations/outcome refresh, stale/unavailable recovery, desktop/mobile layout, and the scoped rate-limit message with local retry time. Regression tests also cover independent owners on one IP, concurrent cookie rotation, TTL expiry and ownership isolation. The compatible body-parser lockfile update clears npm audit; focused usage browser checks run in CI.
Deployment: the usage indicator and shared-network session-limit improvement are live at https://bibref-server.vercel.app/ from commit b202cf4. The staged deployment and promoted public site passed browser/native smoke checks; the bounded post-deploy error-log scan returned zero records. Engine and existing feature configuration were preserved; no environment settings were changed.
Full server CI passed, including all 33 server tests, audit, usage browser checks, Python runtime/native browser acceptance, terminal acceptance, and native cancellation. CI-only corrections give the isolated batched acceptance fixture an adequate request allowance and separate the bounded book catalogue data from the unchanged terminal code/style budget.