[juliusmarminge]

discoverSourceControl waited on the slowest provider; Bitbucket's /2.0/user took 10.5 s in a sampled trace even with no Bitbucket credential.

Metric (24h, fleet traces)	Before	After
ws.rpc.server.discoverSourceControl p50 / p95 / p99	2.1 s / 8.6 s / 17 s	worst case bounded by CLI probes (5 s)
Bitbucket API calls without a credential	~460/day	0
API provider probe ceiling	30 s (request timeout)	3 s, then auth "unknown"

• CLI providers run --version and auth status concurrently.
• Tests: no Bitbucket request without a credential; a provider that never answers still lets discovery finish.

---

Claude Opus 5.5 in T3 Code (Claude Code harness).

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 47c5c5b

Macroscope's review found this PR approvable — Source-control discovery now bounds API waits, runs CLI checks concurrently, and skips unauthenticated Bitbucket requests. The changes affect status reporting rather than permissions or stored credentials, with bounded probes and an explicit unknown-status fallback.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	−6 B (−0.1%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.2 KiB	−6 B (−0.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.6 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: 08a463e · PR result: 47c5c5b · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: perf/source-control-discovery
• File: .coderabbit.config.ts
• Commit: 47c5c5b
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: d28672e0-49e9-4bf5-b739-968c9366e2b6

Commits

Reviewing files that changed from the base of the PR and between 08a463e and 47c5c5b.

Files selected for processing: 4

• apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
• packages/source-control-bitbucket/src/server/BitbucketApi.test.ts
• packages/source-control-bitbucket/src/server/BitbucketApi.ts
• packages/source-control-core/src/server/discovery.ts

Limit details: You’ve used all 10 included reviews currently available.

Walkthrough

Source-control authentication discovery now handles missing Bitbucket credentials without requesting /user, bounds API authentication probes to three seconds, and runs CLI version and authentication probes concurrently.

Changes: Source control discovery

Layer / File(s)	Summary
Credential-aware Bitbucket probe packages/source-control-bitbucket/src/server/BitbucketApi.ts, packages/source-control-bitbucket/src/server/BitbucketApi.test.ts	When no credential is configured, probeAuth returns unauthenticated details without requesting /user. The test checks that the probe makes no HTTP request.
Bounded and concurrent discovery probes packages/source-control-core/src/server/discovery.ts, apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts	API authentication probes time out after three seconds and return unknown auth while the discovery item remains available. CLI version and authentication probes run concurrently; missing CLI status overrides the auth result. Tests cover a Bitbucket probe that does not complete.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Discovery
  participant CLIVersionProbe
  participant CLIAuthProbe
  par Version check
    Discovery->>CLIVersionProbe: Probe CLI version
    CLIVersionProbe-->>Discovery: Return CLI status
  and Authentication check
    Discovery->>CLIAuthProbe: Probe CLI authentication
    CLIAuthProbe-->>Discovery: Return auth result
  end
  Discovery->>Discovery: Apply missing-command detail when CLI is missing

Loading

Possibly related issues

• Issue 17209: The change runs CLI version and authentication probes concurrently, which relates to discovery delays from CLI probes. It does not add host-specific refinement or negative caching.
• Issue 21365: The change skips Bitbucket /2.0/user when credentials are absent. It does not address cross-environment repository assignment.

Suggested reviewers: macroscopeapp, maria-rcks

Merge Risk: Minimal · up to 47c5c

No merge-blocking issue is established. Discovery may take longer in the narrow case where a CLI’s version check fails but its auth check stalls.

Pre-merge checks: 4

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the primary change: preventing slow Bitbucket source-control discovery from stalling the server.
Description check		The description clearly covers the problem, the main implementation changes, concrete impact metrics, and focused verification results. It does not explicitly provide the template's Scope and approval…

Full details: Description check

Explanation

The description clearly covers the problem, the main implementation changes, concrete impact metrics, and focused verification results. It does not explicitly provide the template's Scope and approval section or explain an exemption, but the remaining required information is substantially complete.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}