fix(web): the Usage page sends a signed-out browser to pairing

[AdEx-Partners-DE]

Problem

/usage is the one app route without the auth guard that the chat and settings routes have. When a browser's session ends while a tab is on the Usage page, the tab keeps showing its last snapshot instead of going to pairing: no sidebar, no sidebar toggle, no Back, and stale limits. The same situation on a thread or settings route redirects to /pair. The only way out is the browser's Back button, which lands on the pairing screen.

Reproduction on current main (9afde1c6d), web dev server on Windows 11:

1. Pair a browser and open /usage.
2. End that session, for example t3 auth session revoke <id>.
3. Restart the server so the socket reconnects.
4. The tab stays on /usage with the old numbers. Checking the DOM: the sidebar element, the "Toggle main sidebar" button and the "Back" entry are all gone.

Repeating steps 1 to 3 on a thread route ends on /pair, as expected.

Change

usage.tsx gets the same beforeLoad check as _chat.tsx and settings.tsx: unless the auth gate state is authenticated or hosted-static, redirect to /pair.

Scope and approval

A very small, focused fix for an obvious bug, with no prior issue: one route is missing a guard its sibling routes already have, and the fix is that guard, nine lines in one file. It adds no behavior that does not already exist on the other routes.

Verification

• Reproduced the stuck page as described above, then applied the change: the same tab now ends on /pair (location.pathname === "/pair", pairing form shown).
• A paired browser still opens /usage normally and shows the limits.
• tsc --noEmit for apps/web is clean; lint and format are clean for the file.

Not checked: the packaged desktop app, mobile, and the hosted static app. The guard lets hosted-static through exactly as the chat and settings routes do. No screenshots, since the change is a redirect rather than a visual change; I can add a recording if that helps.

There is no route-level test for the existing guards to extend, so this adds none.

Claude Opus 5.5 in Claude Code, via T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The change is a small and consistent route-guard fix, leaving authenticated and hosted-static Usage behavior unchanged. Because it modifies authentication-gated access to an existing production route, it warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: a26ab2fa-07be-4dcf-a778-3cb36f7fb612

---

📥 Commits

Reviewing files that changed from the base of the PR and between 9afde1c and 7eb8354.

---

📒 Files selected for processing (1)

• apps/web/src/routes/usage.tsx

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The /usage route now checks authentication state before rendering UsagePage. It redirects states other than "authenticated" and "hosted-static" to /pair with replacement.

Changes

Usage Route Access

Layer / File(s)	Summary
Guard usage route apps/web/src/routes/usage.tsx	The route allows "authenticated" and "hosted-static" states. It redirects other states to /pair with replacement.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~7 minutes

Change: Bug fix

---

Merge Risk | ⚪ Minimal · up to 7eb83

Merge Risk: ⚪ Minimal · up to 7eb83

/usage remains available to authenticated and hosted-static browsers, while unauthenticated sessions are routed into the pairing flow. No material merge risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 7eb83

The change narrows access to one browser route and reuses existing pairing behavior. No expanded privileges or new authentication bypass was identified. Redirecting an already-open tab after session revocation still depends on existing authentication-refresh behavior that was not fully established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly changed security surface is admission to one browser page. The added allowlist reduces route reachability for disallowed auth states; the full diff introduces no new server operation, credential authority, or cross-service dependency.

Trust Boundaries and Controls

• observed — The route decision trusts the root-produced auth state. The hosted-static exception already originates in the root's application-mode checks; this PR does not add a new state producer or credential exchange path.

Resilience and Maintainability Implications

• observed — The existing pairing recovery path reports failed credential submission without invoking its authenticated callback. Successful submission waits for an authenticated session, then replaces history and reloads the application to recreate the primary connection with the new cookie.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: redirecting signed-out browsers from the Usage page to pairing.
Description check		The description covers the problem, reproduction steps, implementation, scope rationale, verification results, untested environments, and agent details. It is focused and complete for this small redir…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}