[saphid]

Bitbucket’s pull request list can stall on Load More when a full page shares one update timestamp. The next request returns the same prefix, and local deduplication removes it without reaching the remaining tied or older pull requests.

The listing service now passes already-delivered boundary IDs through the existing internal provider cursor. Bitbucket excludes those IDs in its API query before limiting results. Serialized boundary IDs are deduplicated. The wire cursor format and other providers’ pagination behavior stay unchanged.

Maintainer takeover of #18813, crediting @saphid and Alex Southwell for the original contribution. Contributor commits are preserved and main is merged. Independent implementation review retained the original production approach because it is already the smallest correct solution; duplicate API-level regression coverage was removed.

Verification on headless Linux:

• Original: two added regressions across two existing files, 261 focused cases. Final: one integration regression in the existing service suite, 260 focused cases. Existing main tests are preserved with the two necessary cursor expectations updated.
• Pinned-main production: 257 pass / 3 fail, including a stalled second page. Final: 432 cases pass across eleven focused and related files. Scoped types, lint, formatting, and diff checks pass.
• The real service, Bitbucket provider and API run with only external HTTP mocked. Three tied PRs plus two older ones at limit two yield [1,2], [3,4], [5] and terminate. Existing coverage verifies deduplicated cursor serialization.
• A live public Bitbucket request for atlassian/aui accepted the composed timestamp and ID exclusion query (HTTP 200), omitted the delivered boundary ID, and returned older PRs. This verifies query semantics; the exact tied-page case is proved by the integration test.
• Independent whole-PR reviews from Claude Opus 5.5 and GPT-6 Sol found no bugs in round one. Current head 2b5c6b77f8 passed CI, including Test Web, lint, build/typecheck, package tests, all server shards, aggregate Check, and the latest native fingerprint run. One earlier duplicate fingerprint run was cancelled and superseded by the successful run. Macroscope approved this head and its correctness/appovability checks passed; the stale inline finding is resolved. CodeRabbit’s displayed reviewed range remains older, with no new actionable comments.

Test and live API proof.

The historical Macroscope finding names a batched-provider test whose input still contains only updatedBefore and delivered. The new field is forwarded only on the separate per-repository path. The named test passes with its original input expectation; changing it as requested would be incorrect.

Not verified: an authenticated Bitbucket account or live tied group, the full UI Load More flow, macOS, Windows, iOS, Android, or Electron desktop. No visual layout changes. This fixes repeated tied pages with millisecond-aligned boundaries. Existing sub-millisecond timestamp normalization can still skip ties; it and very large exclusion-query limits remain outside scope. No merge is authorized.

Tests: GPT-6 Astra (high); implementation: GPT-6.1 Sol (high); reviews: Claude Opus 5.5 and GPT-6 Sol. Coordinated with GPT-6.1 Sol through the Codex harness in T3 Code.

[macroscopeapp]

Approvability

Verdict: Approved at 2b5c6b7

Macroscope's review found this PR approvable — This is a small, self-contained Bitbucket pagination bug fix that carries boundary IDs through the existing cursor and excludes them before page limiting. Production changes are narrowly scoped, other providers retain their existing behavior, and the tied-timestamp continuation case is covered by an integration regression test.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Warning

Review limit reached

Only developers with an assigned seat can use this organization's usage-based review budget, and seats here are assigned manually. Ask an admin to assign a seat, or change the review continuation mode in Billing.

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7761f9cb-38d3-4d53-bf18-37f92bfda9f2

📥 Commits

Reviewing files that changed from the base of the PR and between f34ba43 and e1bf008.

📒 Files selected for processing: 4

• apps/server/src/pullRequest/PullRequestService.test.ts
• apps/server/src/pullRequest/PullRequestService.ts
• packages/source-control-bitbucket/src/server/BitbucketPullRequestApi.ts
• packages/source-control-core/src/server/PullRequestProvider.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: e629bd0e-e489-4d9c-a36f-2962e376be14

📥 Commits

Reviewing files that changed from the base of the PR and between 511d20c and 239b635.

📒 Files selected for processing (5)

• apps/server/src/pullRequest/PullRequestService.test.ts
• apps/server/src/pullRequest/PullRequestService.ts
• packages/source-control-bitbucket/src/server/BitbucketPullRequestApi.test.ts
• packages/source-control-bitbucket/src/server/BitbucketPullRequestApi.ts
• packages/source-control-core/src/server/PullRequestProvider.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Pull request cursors now carry IDs already returned at the timestamp boundary. The service deduplicates these exclusions and passes them to providers. The Bitbucket provider excludes those IDs before applying the page limit. Tests cover tied timestamps across successive pages.

Changes: Timestamp pagination

Layer / File(s)	Summary
Cursor exclusions and provider input packages/source-control-core/src/server/PullRequestProvider.ts, apps/server/src/pullRequest/PullRequestService.ts, apps/server/src/pullRequest/PullRequestService.test.ts	ProviderListCursor adds optional seenAt. The service deduplicates boundary row IDs and passes them to providers with the timestamp and delivered count. Service tests cover the cursor input and exclusion list.
Bitbucket boundary filtering packages/source-control-bitbucket/src/server/BitbucketPullRequestApi.ts, packages/source-control-bitbucket/src/server/BitbucketPullRequestApi.test.ts, apps/server/src/pullRequest/PullRequestService.test.ts	The Bitbucket provider excludes seenAt IDs while retaining the inclusive timestamp boundary and optional search filter. Tests cover three successive pages across tied timestamps.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 239b6

The pagination change has no identified merge-blocking issue after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 239b6

The change preserves repository selection and constrains cursor values before using them in Bitbucket queries. No authorization bypass was identified. Large exclusion lists remain an unverified compatibility risk because they expand the outgoing request.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The new cursor influence is limited to narrowing listing results for selected configured Bitbucket repositories. It does not itself select another repository, credential, destination host, or write operation.

Trust Boundaries and Controls

• observed — Although cursors return from the client, IDs must match one-to-nine-digit numeric components before reaching the service’s provider call. Bitbucket joins their exclusion predicates with AND. The public schema caps each cursor at 4096 characters, but this does not establish a compatible encoded-request size.

Resilience and Maintainability Implications

• observed — The existing repository-failure branch contains a failed listing to that repository and reports an error rather than blanking the whole page. It returns no continuation for that failed repository, so it is containment rather than transparent recovery.

Hardening Proposals

• proposed — Establish an encoded-query budget against supported Bitbucket and intermediary limits, with an explicit restart or fallback policy for large tied groups that does not silently discard exclusions.

Pre-merge checks: 4

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the Bitbucket pagination fix for pull requests with tied update timestamps.
Description check		The description covers the problem, implementation, scope approval, verification results, limitations, and agent attribution. It does not use the template's explicit section headings, but the required…

Full details: Description check

Explanation

The description covers the problem, implementation, scope approval, verification results, limitations, and agent attribution. It does not use the template's explicit section headings, but the required information is present and sufficiently detailed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate 110fc24

[juliusmarminge]

Taking over this one as maintainer for batch pull-request-07. I will preserve the contributor commits and this PR, merge main, reduce duplicate pagination coverage, and rebuild the internal cursor handoff and Bitbucket exclusion at the existing service boundary. Fresh test and implementation agents and independent whole-PR reviews will verify the result. No merge is planned.

[juliusmarminge]

@coderabbitai full review

@macroscope-app review

[macroscopeapp]

Manual reviews triggered for commit e1bf008:

• Approvability Check
• Correctness Check

• Effect Service Conventions

^{All prior checks · these links stay valid even if you push more commits.}

[macroscopeapp]

Review triggered; results will be posted in the check runs.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 14 minutes.