Nightly -> Main

[karishnu]

Summary

Reduces rate limits for app creation and LLM calls, and updates the AI PR review workflow to use the latest opencode version.

Changes

• Rate Limits: Significantly reduced limits for both app creation and LLM calls
  • App creation: 10 per 4h → 3 per 24h
  • LLM calls: 500 per 2h + 1700 daily → 250 per 24h
• AI Review Workflow: Changed opencode_version from 1.2.27 to latest

Motivation

Tightening rate limits to control resource usage and costs. The opencode version update ensures the AI PR review workflow uses the latest available version.

Testing

• Verify rate limiting behavior in staging environment
• Confirm AI PR review workflow runs successfully with the updated opencode version

Breaking Changes

Users will experience stricter rate limits:

• App creation limited to 3 per day (was 10 per 4 hours)
• LLM calls limited to 250 per day (was 1700 per day)

[ask-bonk]

UnknownError: TypeError: sdk.languageModel is not a function. (In 'sdk.languageModel(model.api.id)', 'sdk.languageModel' is undefined)

github run

[ask-bonk]

@karishnu Bonk workflow failed. Check the logs for details.

View workflow run · To retry, trigger Bonk again.

[github-actions]

Claude finished @karishnu's task in 1m 17s —— View job

---

Code Quality & Security Review

Recommendation: APPROVE

PR Summary

This PR significantly reduces rate limits for app creation (10 per 4h → 3 per 24h) and LLM calls (500 per 2h + 1700 daily → 250 per 24h), and updates the AI PR review workflow to use the latest opencode version.

PR Description

• Updated: Yes
• Notes: Corrected description to accurately reflect the actual diff (opencode_version change, not model change)

Addressed Issues

• None explicitly linked

Code Quality

Severity	Count	Details
Critical	0	-
High	0	-
Medium	1	See below
Low	1	See below

Medium - Redundant dailyLimit Configuration (worker/services/rate-limit/config.ts:82-84)

• Setting limit: 250 with period: 24h and dailyLimit: 250 is semantically redundant since the period-based limit already restricts to 250 per 24 hours
• Same applies to appCreation (limit: 3, period: 24h, dailyLimit: 3)
• Not a bug, but adds unnecessary complexity. Consider removing dailyLimit or documenting why both are needed

Low - Using 'latest' for opencode_version (.github/workflows/ai-pr-review.yml:42)

• Using 'latest' instead of a pinned version may introduce unexpected behavior when new versions are released
• Consider pinning to a specific version for reproducible builds, or document this is intentional

Security

Severity	Count	Details
Critical	0	-
High	0	-
Medium	0	-
Low	0	-

No security concerns identified. Rate limit reductions improve resource protection.

Testing

• Rate limiting behavior should be verified in staging environment
• AI PR review workflow should be tested with the new opencode version

Final Recommendation

APPROVE - The changes are straightforward configuration updates with no bugs or security issues. The rate limit reductions will help control costs and resource usage. The minor redundancy in the rate limit config and unpinned version are acceptable trade-offs.

---

Tasks:

• Gather context and read project guidelines
• Get PR diff and analyze changes
• Review code quality and security
• Post comprehensive review summary

[ask-bonk]

UnknownError: CLOUDFLARE_GATEWAY_ID missing. Set with: export CLOUDFLARE_GATEWAY_ID=

github run

[ask-bonk]

The analysis is complete. This is a clean, straightforward configuration change PR. Let me assess what's worth flagging:

Changes reviewed:

1. Rate limit config (config.ts): Reduces limits and extends periods. The dailyLimit being equal to limit when period is 24h is redundant but not a bug — it's a no-op safeguard.
2. Workflow file (ai-pr-review.yml): Pins opencode_version to latest instead of a specific version. Also fixes indentation (tabs replacing mixed spaces).

Both changes are intentional, well-understood configuration updates. The redundant dailyLimit is a minor style/maintenance point, and the latest version pin is a conscious trade-off. Neither rises to "Needs Fix" level. The previous reviewer already flagged both of these as low/medium informational items.

This PR is clean.

LGTM!

github run