fix: address code review feedback

- Use array index as React key in claude-code-limits.tsx to avoid
  reconciliation bugs when tokens share the same trailing 4 chars;
  suppress noArrayIndexKey lint rule with explanation
- Fix contradictory JSDoc on cacheByToken — remove false claim that
  raw tokens are not stored as cache keys
- Remove unused createMockUser import in claudeCodeLimits.test.ts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Cascade Bot

src/anthropic/client.ts

@@ -18,9 +18,8 @@ interface CacheEntry {
 }
 
 /**
- * Per-token cache. Keyed by masked token representation to avoid storing raw
- * tokens as cache keys. Uses a Map keyed by full token for lookup; only the
- * masked value is surfaced in returned data.
+ * Per-token cache. Keyed by full token for lookup; only the masked value is
+ * surfaced in returned data.
  */
 const cacheByToken = new Map<string, CacheEntry>();
 

tests/unit/api/routers/claudeCodeLimits.test.ts

@@ -1,9 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
-import {
-	createMockContext,
-	createMockSuperAdmin,
-	createMockUser,
-} from '../../../helpers/factories.js';
+import { createMockContext, createMockSuperAdmin } from '../../../helpers/factories.js';
 import { createCallerFor, expectTRPCError } from '../../../helpers/trpcTestHarness.js';
 
 const { mockListAllClaudeCodeCredentials, mockFetchClaudeSubscriptionLimits } = vi.hoisted(() => ({

web/src/components/global/claude-code-limits.tsx

@@ -36,27 +36,32 @@ export function ClaudeCodeLimitsSection() {
 				Limits
 			</div>
 			<div className="flex flex-col gap-2 px-3 py-1">
-				{data.map((limits) => (
-					<div key={limits.tokenMasked} className="rounded-md bg-sidebar-accent/30 p-2 text-xs">
-						<div className="font-medium text-sidebar-foreground truncate mb-1">
-							{limits.tokenMasked}
-						</div>
-						<div className="text-muted-foreground mb-0.5 capitalize">{limits.plan}</div>
-						{limits.messagesLimit > 0 && (
-							<div className="text-muted-foreground">
-								Msgs: {formatNumber(limits.messagesUsed)} / {formatNumber(limits.messagesLimit)}
-							</div>
-						)}
-						{limits.tokensLimit > 0 && (
-							<div className="text-muted-foreground">
-								Tokens: {formatNumber(limits.tokensUsed)} / {formatNumber(limits.tokensLimit)}
+				{data.map((limits, i) => {
+					return (
+						// biome-ignore lint/suspicious/noArrayIndexKey: tokenMasked is not guaranteed unique (tokens may share trailing 4 chars); index is safe here as list order is server-determined and stable
+						<div key={i} className="rounded-md bg-sidebar-accent/30 p-2 text-xs">
+							<div className="font-medium text-sidebar-foreground truncate mb-1">
+								{limits.tokenMasked}
 							</div>
-						)}
-						{limits.resetsAt && (
-							<div className="text-muted-foreground">Resets {formatResetDate(limits.resetsAt)}</div>
-						)}
-					</div>
-				))}
+							<div className="text-muted-foreground mb-0.5 capitalize">{limits.plan}</div>
+							{limits.messagesLimit > 0 && (
+								<div className="text-muted-foreground">
+									Msgs: {formatNumber(limits.messagesUsed)} / {formatNumber(limits.messagesLimit)}
+								</div>
+							)}
+							{limits.tokensLimit > 0 && (
+								<div className="text-muted-foreground">
+									Tokens: {formatNumber(limits.tokensUsed)} / {formatNumber(limits.tokensLimit)}
+								</div>
+							)}
+							{limits.resetsAt && (
+								<div className="text-muted-foreground">
+									Resets {formatResetDate(limits.resetsAt)}
+								</div>
+							)}
+						</div>
+					);
+				})}
 			</div>
 		</div>
 	);