fix: hide email-bearing account labels in usage limits

[juliusmarminge]

/usage-limits renders account labels verbatim, including proxy account filenames containing email addresses. This exposes emails during screen sharing.

Hide labels containing @ until clicked or tapped, and allow hiding them again. Web and desktop reuse the existing blurred placeholder component in both the single-account heading and multi-account rows. Mobile uses its existing masked-text treatment. Changing the label resets its reveal state; plan names and quota bars stay readable.

Verification:

• Web and mobile typechecks, targeted lint, and formatting passed.
• Exercised the actual web composer with synthetic account data: single and multiple accounts, click to reveal/hide, reopening hidden, keyboard Enter/Space, and the narrow-screen details popover.
• Native runtime verification was unavailable on this Linux host because no Android SDK/emulator is installed.
• No contracts or provider adapters changed; the rendering fix applies to local and remote reports. Existing Settings email redaction remains in place. No documentation change is needed.

Before, from the PR merge base, with synthetic data:

After, with the same data and viewport:

Click to reveal and hide, cropped from the actual browser recording and played at 2× speed:

Model: GPT-6. Harness: Codex.

Note

Hide email-bearing account labels in usage limits

• Adds AccountInstanceLabel to mobile usage-limit rows and AccountSummary to web composer usage limits; both render labels containing @ through a masked, pressable reveal/hide control.
• Labels without @ and plan text remain directly visible.
• Risk: any caller relying on the raw inline account-label text in UsageLimitsSection.tsx or ComposerUsageLimits.tsx will now receive a component element instead of a plain string for @-bearing labels.

^{Macroscope summarized 58cf83b.}

Summary by CodeRabbit

• New Features
  • Sensitive account labels are now masked by default in usage-limit displays.
  • Added controls to reveal or hide masked account labels.
  • Account summaries now consistently include the account plan where available.
  • Non-account labels continue to display normally.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes production UI behavior for email-bearing account labels by adding default redaction and user-triggered reveal interactions on web and mobile. The scope is narrow and the surrounding usage-limit behavior is unchanged, but handling potentially sensitive account data warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.6 KiB	+23 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.1 KiB	+23 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	0 B (0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	−40 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.1 KiB	+18 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.5 KiB	−58 B (−0.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.9 KiB	57.8 KiB	−88 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	8	−2 (−20.0%)	21	✅

Baseline: b155c21 · PR result: 58cf83b · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 7472b07e-a69a-4661-b991-8b3daddb109f

📥 Commits

Reviewing files that changed from the base of the PR and between 5a18fb9 and 58cf83b.

📒 Files selected for processing (2)

• apps/mobile/src/features/usage/UsageLimitsSection.tsx
• apps/web/src/components/chat/ComposerUsageLimits.tsx

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Usage-limit views now use dedicated components to redact account labels containing @. Mobile provides an accessible reveal or hide control. Web summaries also append the account plan.

Changes

Account label redaction

Layer / File(s)	Summary
Mobile account label masking apps/mobile/src/features/usage/UsageLimitsSection.tsx	AccountInstanceLabel masks account-style labels and supports accessible reveal or hide behavior. AccountLimits uses the component.
Web account summary integration apps/web/src/components/chat/ComposerUsageLimits.tsx	AccountSummary redacts account-style labels, appends the plan, and replaces inline summary formatting in banner and multi-account views. The multi-account fallback string remains unchanged.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 58cf8

Usage-limit account labels containing email-style text are now masked by default with reveal controls, while plans and quota information remain visible. The supplied validation and current implementation evidence indicate no actionable merge-blocking risk.

Suggested reviewers: chrisdeeming

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the problem, implementation, scope, verification, limitations, and UI changes. It includes before/after screenshots and an interaction recording. The explicit Checklis…
Title check	✅ Passed	The title is concise, specific, and accurately summarizes the primary change: hiding account labels that contain email addresses in usage limits.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch t3code/blur-usage-limit-emails

---

_{Comment @coderabbitai help to get the list of available commands.}

[juliusmarminge]

Reviewed CodeRabbit's docstring-coverage warning against the two changed files. The new helpers only render account labels and toggle their visibility; their names and implementation explain that behavior. Adding comments solely to reach a percentage would repeat the code, contrary to the repository's documentation guidance. No code change is needed for this warning.

All CI jobs that ran passed, and CodeRabbit reported no actionable findings. Macroscope's correctness and UI checks passed; its separate approvability check is neutral and reserves this sensitive-data UI change for human review. The PR remains unmerged.