docs: setup.md cron section covers both authenticated cron routes

[vlad-ko]

Follow-up to the Qodo finding on #143 that posted after merge: docs/setup.md's Vercel Cron section still framed CRON_SECRET and the vercel.json snippet as recovery-sweep-only, while the repo now ships a second fail-closed cron route (/api/cron/code-index). An operator following setup.md verbatim would get a silently-401ing code index. The snippet now shows both crons; the prose and env-table row state that the secret gates both routes.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
battle-mage	Ready	Preview, Comment	Jul 9, 2026 3:35pm

[coderabbitai]

Warning

Review limit reached

@vlad-ko, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1607ef3d-f6dc-4c8e-a1f1-79d9a2cedcb4

📥 Commits

Reviewing files that changed from the base of the PR and between 920ee59 and 31bbf12.

📒 Files selected for processing (1)

• docs/setup.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/setup-cron-both-routes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Docs: Clarify CRON_SECRET protects both Vercel cron routes

📝 Documentation 🕐 Less than 10 minutes

AI Description

• Update Vercel cron snippet to schedule both sweep and code-index routes.
• Clarify CRON_SECRET authentication applies to both cron endpoints and fails closed.
• Align env var table description with current cron route behavior.

Diagram

graph TD
  VCron(["Vercel Cron"]) --> Secret{"CRON_SECRET set?"}
  Secret -->|"yes"| Sweep["/api/cron/sweep"] --> Recovery["Recovery sweep"]
  Secret -->|"yes"| Index["/api/cron/code-index"] --> Build["Code index build"]
  Secret -->|"no"| Deny["401 deny"]

  subgraph Legend
    direction LR
    _svc(["Service/runner"]) ~~~ _dec{"Decision"} ~~~ _api["API route"] ~~~ _err["Error result"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Avoid duplicating cron config in docs (link to vercel.json)

• ➕ Eliminates drift between docs and actual deployment configuration
• ➕ Reduces maintenance when cron routes/schedules change
• ➖ Less copy/paste friendly for operators reading setup.md
• ➖ Still requires prose to explain CRON_SECRET behavior

2. Generate the cron snippet in docs from vercel.json (doc build step)

• ➕ Keeps docs snippet always in sync with source of truth
• ➕ Preserves copy/paste usability while preventing stale examples
• ➖ Adds tooling/CI complexity for a small documentation benefit
• ➖ May be overkill for a small project

Recommendation: The PR’s approach (update setup.md snippet + explicitly state CRON_SECRET gates both routes) is the right immediate fix and minimizes operator confusion. If cron routes are expected to evolve further, consider referencing vercel.json or generating the snippet to prevent similar drift.

Files changed (1) +4 / -3

Documentation (1) +4 / -3

setup.mdDocument both authenticated Vercel cron routes +4/-3

Document both authenticated Vercel cron routes

• Updates the Vercel Cron JSON snippet to include both /api/cron/sweep and /api/cron/code-index. Clarifies that CRON_SECRET authentication applies to both endpoints and that missing configuration fails closed (401). Updates the CRON_SECRET row in the environment variable table to match this behavior.

docs/setup.md