fix(bedrock): disclose monitoring charges in settings

[steipete]

Bedrock monitoring can add AWS charges, but setup previously showed no warning. Show the per-request Cost Explorer price, explain that refreshes can make multiple requests, and link to current AWS pricing. The Connection section also explains the shared refresh controls and that the displayed budget does not cap billing.

Refs #3387. This addresses the in-app disclosure; keep the issue open for the separate Bedrock-specific interval decision. Scheduling and credential handling are unchanged. Thanks @kyen99 for reporting the surprise charge and providing the pricing reference.

Validation: make check passed; make test passed all 1,035 selections in 87 groups with no failures or retries. Independent branch review is clean through P2. A Developer ID-signed app exercised the production settings pane in both authentication modes using synthetic defaults. The built CLI returned $12.50 from a loopback AWS fixture, with one Cost Explorer and one CloudWatch request. No real account or credential was used.

The before image uses the original main implementation; the after images use this PR's production code.

Before	After

Profile-mode proof. Release notes are collected separately in #3499.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 8, 2026, 3:39 AM ET / 07:39 UTC.

ClawSweeper review

What this changes

Adds AWS monitoring-charge warnings, a pricing link, and guidance on existing refresh controls to Bedrock settings, with focused tests and documentation.

Merge readiness

✅ Ready for maintainer review

This remains a useful, narrowly scoped contribution: main documents the charges but lacks the in-app disclosure. The supplied screenshots demonstrate the intended result in both authentication modes, and no blocking defects were found.

Priority: P2
Reviewed head: 25cf6923983f88bcd2976acd073083b6189170f9

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused implementation with direct visual proof, relevant tests, and no blocking findings.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (screenshot): The inspected before/after native screenshots directly demonstrate the changed production settings pane: both authentication modes show the full disclosure above credential fields using synthetic defaults.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (screenshot): The inspected before/after native screenshots directly demonstrate the changed production settings pane: both authentication modes show the full disclosure above credential fields using synthetic defaults.
Evidence reviewed	9 items	Introduced change: The pinned base-to-head delta contains only 35 production lines, 20 test lines, and 2 documentation lines; it does not change scheduling, credential handling, defaults, or persistence. Production rendering: The existing Connection section renders settings actions before credential fields. The shared action row supports multiline disclosure text and an empty action list, so both added groups use established rendering behavior. Observed native UI proof: Inspected all three prepared screenshots. The before image lacks disclosure; the after images visibly show the price, multiple-request warning, budget limitation, pricing link, and refresh guidance above credential fields in access-key and profile modes. The captured PR body identifies these as production settings panes in a Developer ID-signed app using synthetic defaults. The unrelated CLI fixture result is supplemental.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s Bedrock provider reads AWS spending and activity data through potentially billed APIs. Its settings pane presents authentication controls and now explains those monitoring costs before credential entry.

flowchart TD
  A[Bedrock provider settings] --> B[Connection section]
  B --> C[Monitoring cost disclosure]
  B --> D[Authentication fields]
  C --> E[AWS pricing page]
  C --> F[Shared refresh guidance]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +35, tests +20, docs +2; 0 removed	The production growth is justified by two disclosure groups using existing settings components.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3387
Summary: This PR addresses the disclosure portion of the canonical report; its separate scheduling request remains open.

Members:

• canonical: Monitoring AWS Bedrock carries a cost #3387 - Tracks monitoring costs, in-app disclosure, and the separate interval request.
• partial_overlap: docs(bedrock): disclose monitoring API charges #3393 - Merged documentation coverage of the same charges, without the settings disclosure.
• adjacent_distinct: docs(changelog): collect Claude menu and Bedrock disclosure fixes #3499 - Collects release notes for this implementation and other work.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep cost disclosure beside Bedrock authentication and reuse shared refresh controls, leaving provider-specific scheduling to the existing issue’s separate decision.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a broken-behavior reproduction: this is a disclosure improvement. Source comparison and before/after screenshots establish the missing and added UI.

Is this the best way to solve the issue?

Yes. Existing settings descriptors provide the disclosure without introducing competing scheduling controls or changing stored preferences.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against c3f3ea1faf70.

Labels

Label justifications:

• P2: The disclosure addresses reported unexpected monitoring charges through a bounded settings improvement.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The inspected before/after native screenshots directly demonstrate the changed production settings pane: both authentication modes show the full disclosure above credential fields using synthetic defaults.
• proof: sufficient: Contributor real behavior proof is sufficient. The inspected before/after native screenshots directly demonstrate the changed production settings pane: both authentication modes show the full disclosure above credential fields using synthetic defaults.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The inspected before/after native screenshots directly demonstrate the changed production settings pane: both authentication modes show the full disclosure above credential fields using synthetic defaults.

Evidence

What I checked:

• Introduced change: The pinned base-to-head delta contains only 35 production lines, 20 test lines, and 2 documentation lines; it does not change scheduling, credential handling, defaults, or persistence. (Sources/CodexBar/Providers/Bedrock/BedrockProviderImplementation.swift:28, 25cf6923983f)
• Production rendering: The existing Connection section renders settings actions before credential fields. The shared action row supports multiline disclosure text and an empty action list, so both added groups use established rendering behavior. (Sources/CodexBar/PreferencesProviderDetailView.swift:163, 25cf6923983f)
• Observed native UI proof: Inspected all three prepared screenshots. The before image lacks disclosure; the after images visibly show the price, multiple-request warning, budget limitation, pricing link, and refresh guidance above credential fields in access-key and profile modes. The captured PR body identifies these as production settings panes in a Developer ID-signed app using synthetic defaults. The unrelated CLI fixture result is supplemental. (25cf6923983f)
• Official pricing contract: The AWS Cost Explorer pricing page confirms the displayed $0.01 charge per request using the primary billing view. This is the external pricing contract explicitly cited by the patch.
• Refresh guidance matches implementation: Manual returns before recurring scheduling; startup separately invokes refresh. General settings expose the shared interval and menu-open refresh controls, and the provider refresh path rejects disabled providers. Bedrock fetching includes monthly Cost Explorer requests, pagination, and optional CloudWatch activity. (Sources/CodexBar/UsageStore.swift:918, 25cf6923983f)
• Main and release still lack settings disclosure: Inspected the provider implementation at fetched main and v0.56.8; both contain authentication and credential settings without the new disclosure groups. The merged documentation change at docs(bedrock): disclose monitoring API charges #3393 does not replace this UI contribution. (Sources/CodexBar/Providers/Bedrock/BedrockProviderImplementation.swift:28, 6ef82690b4a7)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-08T07:11:02.999Z sha 25cf692 :: needs maintainer review before merge. :: none

[steipete]

Verified head 25cf692. CI is green: https://github.com/steipete/CodexBar/actions/runs/34197590817.

make check passed. make test passed all 1,035 selections in 87 groups, with no failed, retried, or timed-out groups. Independent branch review is clean through P2.

A Developer ID-signed app exercised the production Bedrock settings pane with empty synthetic credentials. The disclosure and pricing link remained visible when switching from Access keys to AWS profile. The PR body contains the signed main-baseline and candidate screenshots. The real built CLI also returned the expected $12.50 from a loopback AWS fixture, with one Cost Explorer request and one CloudWatch request; no real AWS account was used.

This completes the in-app disclosure portion of #3387. Keep that issue open for its separate provider-specific interval decision. Changelog notes are in #3499, which must land after the code PRs.