Skip to content

Add CLIProxyAPI cost attribution - #2457

Open
EClinick wants to merge 220 commits into
steipete:mainfrom
EClinick:task/ec/codex-proxy-attribution
Open

Add CLIProxyAPI cost attribution#2457
EClinick wants to merge 220 commits into
steipete:mainfrom
EClinick:task/ec/codex-proxy-attribution

Conversation

@EClinick

@EClinick EClinick commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Summary

  • attribute Claude Code sessions routed through CLIProxyAPI using endpoint, installation, inventory, and request-log evidence
  • price confirmed proxied GPT usage in Codex totals while preserving route, backend, and auth provenance
  • surface proxy attribution in the spend dashboard and collect bounded CLIProxyAPI telemetry
  • serialize destructive telemetry collection and preserve full dashboard and synthetic-project attribution identities
  • keep proxy telemetry present for scoped callers while loading it exactly once beside account-scoped dashboard sources
  • persist each destructive queue batch before the next pop and surface cache-write failures
  • enforce the 366-day telemetry retention cutoff even when the proxy queue is empty
  • preserve request-log attribution beyond the newest 500 files
  • load the siloed proxy source for Claude-only dashboard configurations
  • retain Claude-only proxy spend through forced-refresh reconciliation
  • skip telemetry cache rewrites when an empty queue poll leaves the cache unchanged
  • filter expired telemetry during cache reads even when collection is unavailable
  • make request-log attribution loading cancellation-aware in full and cached scan paths
  • price aliased proxy usage from the telemetry-resolved upstream model
  • quarantine unresolved known foreign models from Claude totals while preserving confirmed non-Codex proxy attribution
  • refresh and retry proxy-only scans when a telemetry-confirmed upstream model is still unpriced
  • request refreshed pricing for the telemetry-resolved upstream model when its Claude-facing alias differs
  • resolve OpenAI-compatible proxy models across vendor catalogs after refresh instead of treating transport as vendor
  • keep global CLIProxyAPI supplemental usage out of account-scoped Codex scans
  • index retained proxy telemetry by canonical model and binary-search its bounded timestamp window
  • cache parsed CLIProxyAPI request logs by path, modification date, and size while pruning deleted paths
  • preserve explicit full-rescan semantics by bypassing the request-log cache when forced
  • resolve the default CLIProxyAPI home when hydrating cached spend through the production cache-root initializer
  • prefer timestamped request-log observations over undated fallbacks during telemetry correlation
  • migrate cost caches and add cross-provider regression coverage

Verification

  • DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer make check
  • DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer make test (972 selections, 81 groups, all passed on the first attempt; 0 retries/timeouts)
  • DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer xcrun swift test --disable-sandbox --skip-build --filter 'queue client blocks hostile redirects before redirected IO' (real loopback I/O; redirected endpoint received 0 requests and 0 bearer headers)
  • swift test --filter SpendDashboardProxyAttributionTests
  • DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift test --filter CLIProxyAPIAttributionResolverTests (24 tests)
  • DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift test --filter CostUsageFetcherCacheSnapshotTests (13 tests)
  • swift test --filter CostUsageFetcherTests (18 tests)
  • focused resolver and fetcher suites together (40 tests)
  • DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift test --filter CostUsageFetcherUnknownModelPricingTests (7 tests)
  • swift test --filter SpendDashboardCodexProxySourceTests (2 tests)
  • swift test --filter SpendDashboardForceStateMachineTests (14 tests)
  • focused resolver, proxy-source, and dashboard-controller suites (47 tests)
  • focused SpendDashboardTokenProvenanceTests, SpendDashboardControllerTests, CostUsageCacheTests, and CostUsageScannerClaudeFableTests

Redirect final-effect proof

  • Ran the production CLIProxyAPIUsageQueueClient against two real ephemeral loopback HTTP servers with a redacted proof token.
  • The origin received one bearer-authenticated queue request and returned a hostile 307 redirect to the capture server.
  • The redirect guard refused the redirect before final I/O: the capture server received 0 requests and 0 Authorization headers.
  • No production credential, provider request, account state, or Keychain access was used.

Copilot AI review requested due to automatic review settings July 25, 2026 23:59

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c82dab5a6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/CLIProxyAPIAttributionResolver.swift Outdated
Comment thread Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift Outdated
Comment thread Sources/CodexBar/SpendDashboardModel.swift Outdated
Comment thread Sources/CodexBarCore/CostUsageFetcher.swift
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. merge-risk: 🚨 other 🚨 Merging this PR has meaningful risk outside the owned taxonomy. labels Jul 26, 2026
@clawsweeper

clawsweeper Bot commented Jul 26, 2026

Copy link
Copy Markdown

Codex review: needs real behavior proof before merge. Reviewed August 31, 2026, 1:26 AM ET / 05:26 UTC.

ClawSweeper review

What this changes

This PR adds CLIProxyAPI management-queue telemetry and local attribution so Claude Code proxy usage can be assigned to upstream providers in CodexBar spend views, exports, and shared statistics.

Merge readiness

Blocked until stronger real behavior proof is added - 8 items remain

Keep open: the proposed optional integration has two concrete introduced blockers, including an unavoidable loss window in the destructive CLIProxyAPI queue protocol, so it is not ready to merge or close.

Priority: P2
Reviewed head: 7dd482e5dd9da3b1f9f8dde10ef1791637a17dfd
Owner decision: Required. See Decision needed.

Review scores

Measure Result What it means
Overall readiness 🧂 unranked krab (1/6) The PR has extensive focused tests, but unresolved destructive delivery and missing real configured behavior proof prevent merge readiness.
Proof confidence 🧂 unranked krab (1/6) Needs stronger real behavior proof before merge: Authority-chain proof required: the source test uses the production queue client with local servers for a hostile redirect, but the PR body supplies no captured configured run showing successful queue collection producing attributed dashboard, export, or shared-stat output, nor a recorded initial forbidden-peer rejection before management-key I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🦐 gold shrimp (3/6) Security review found an item that needs attention.

Verification

Check Result Evidence
Real behavior Needs proof Needs stronger real behavior proof before merge: Authority-chain proof required: the source test uses the production queue client with local servers for a hostile redirect, but the PR body supplies no captured configured run showing successful queue collection producing attributed dashboard, export, or shared-stat output, nor a recorded initial forbidden-peer rejection before management-key I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 5 items Destructive dequeue has no acknowledged delivery: The collector calls the destructive queue operation before it can persist the returned records to the pending journal; a process or transport failure in that interval permanently loses attribution telemetry.
Upstream protocol limitation is confirmed in discussion: The contributor confirms that CLIProxyAPI currently pops server-side before returning its only queue endpoint and provides no peek/ack contract: #2457 (comment).
Inline YAML comments break alias-section recognition: The parser compares complete trimmed section headers with exact strings before it removes inline comments, unlike scalar values; valid headers such as oauth-model-alias: # routes or codex: # routes are skipped.
Findings 2 actionable findings [P1] Require acknowledged delivery before destructive dequeue
[P2] Strip inline comments before matching YAML section headers
Security Needs attention Destructive queue operation has no durable acknowledgement: The client sends an authority-bearing management request to a queue that removes records before the client can persist or acknowledge receipt, leaving an unrecoverable failure window.

How this fits together

CodexBar scans local CLI and session data into cost reports, then publishes those reports to the menu-bar usage and spend dashboard. This PR adds an optional CLIProxyAPI queue input and maps its telemetry into the existing attribution, cache, and dashboard pipeline.

flowchart LR
A[Claude Code session logs] --> B[Attribution resolver]
C[CLIProxyAPI management queue] --> D[Telemetry collector]
D --> E[Local cost cache]
B --> E
E --> F[Cost scanner]
F --> G[Spend dashboard and exports]
Loading

Decision needed

Question Recommendation
Should this PR wait for CLIProxyAPI to provide a non-destructive peek-and-ack delivery contract, or should the destructive management-queue feature be removed from this change? Wait for acknowledged delivery: Do not merge queue collection until CLIProxyAPI can retain records until CodexBar has durably acknowledged them.

Why: CodexBar cannot close the server-side destructive-pop-before-response failure window by changing its pending journal alone.

Before merge

  • Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: the source test uses the production queue client with local servers for a hostile redirect, but the PR body supplies no captured configured run showing successful queue collection producing attributed dashboard, export, or shared-stat output, nor a recorded initial forbidden-peer rejection before management-key I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
  • Require acknowledged delivery before destructive dequeue (P1) - pop removes remote records before this code can write the pending journal. A crash or dropped response between those operations loses telemetry permanently; the discussion confirms the server has no peek/ack endpoint, so this client must not consume the queue until that contract exists or the feature is descoped.
  • Strip inline comments before matching YAML section headers (P2) - The parser compares oauth-model-alias: and codex: exactly before normalizing inline comments. Configurations such as oauth-model-alias: # routes therefore skip valid aliases and leave proxied Codex usage unresolved; normalize the header before the comparisons and add coverage.
  • Resolve security concern: Destructive queue operation has no durable acknowledgement - The client sends an authority-bearing management request to a queue that removes records before the client can persist or acknowledge receipt, leaving an unrecoverable failure window.
  • Resolve merge risk (P1) - CLIProxyAPI removes queue records before CodexBar can durably journal them; crashes or network failures in that interval lose upstream-attribution data with no client-side recovery.
  • Resolve merge risk (P1) - The new management-key integration has only source-level loopback redirect coverage, not captured configured after-fix evidence of successful collection and attributed output.
  • Resolve merge risk (P1) - Valid inline-comment YAML configuration can silently disable Codex OAuth alias attribution.

Findings

  • [P1] Require acknowledged delivery before destructive dequeue — Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift:1344-1354
  • [P2] Strip inline comments before matching YAML section headers — Sources/CodexBarCore/CLIProxyAPIAttributionResolver.swift:667-680
  • [medium] Destructive queue operation has no durable acknowledgement — Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift:1344
Agent review details

Security

Needs attention: The new loopback management-key client has an unresolved destructive-delivery boundary that can lose protected telemetry before durable receipt.

Review metrics

Metric Value Why it matters
Introduced code and test delta production +6,359/-537; tests +8,763/-149 The feature adds a large persistence, credential, scanner, and UI surface, increasing the value of proving the external protocol boundary.
Files affected 68 files The change spans the app, CLI, core scanner, cache layer, and dashboard rather than a localized attribution adapter.

Merge-risk options

Maintainer options:

  1. Require an acknowledged queue protocol (recommended)
    Pause merge until the upstream queue keeps records available through a durable CodexBar acknowledgement.
  2. Remove destructive collection
    Land a narrower attribution change without consuming management-queue records if the upstream protocol will not change.
  3. Do not adopt telemetry ingestion
    Close or pause this PR if durable delivery is not worth introducing a new external management-key integration.

Technical review

Best possible solution:

Wait for a CLIProxyAPI delivery protocol that supports durable acknowledgement, then retain telemetry only after acknowledgement and add a narrow parser fix plus configured end-to-end attribution proof.

Do we have a high-confidence way to reproduce the issue?

Yes—source-reproducible. A queue response followed by process termination before pending-journal persistence loses records, and an alias configuration with inline comments fails the exact header comparisons.

Is this the best way to solve the issue?

No. The pending journal improves post-response recovery but cannot make a server-side destructive pop durable; the feature needs an acknowledged upstream delivery contract or a non-destructive design.

Full review comments:

  • [P1] Require acknowledged delivery before destructive dequeue — Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift:1344-1354
    pop removes remote records before this code can write the pending journal. A crash or dropped response between those operations loses telemetry permanently; the discussion confirms the server has no peek/ack endpoint, so this client must not consume the queue until that contract exists or the feature is descoped.
    Confidence: 0.99
  • [P2] Strip inline comments before matching YAML section headers — Sources/CodexBarCore/CLIProxyAPIAttributionResolver.swift:667-680
    The parser compares oauth-model-alias: and codex: exactly before normalizing inline comments. Configurations such as oauth-model-alias: # routes therefore skip valid aliases and leave proxied Codex usage unresolved; normalize the header before the comparisons and add coverage.
    Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 354191af9937.

Labels

Label justifications:

  • P2: This opt-in cost-attribution integration has a bounded but real impact on users who configure CLIProxyAPI.
  • merge-risk: 🚨 security-boundary: The PR stores and sends a management key to a new queue client, while the required forbidden-principal final-effect evidence is incomplete.
  • merge-risk: 🚨 other: The upstream destructive queue contract can permanently discard attribution telemetry before CodexBar can save it.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: the source test uses the production queue client with local servers for a hostile redirect, but the PR body supplies no captured configured run showing successful queue collection producing attributed dashboard, export, or shared-stat output, nor a recorded initial forbidden-peer rejection before management-key I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

  • [medium] Destructive queue operation has no durable acknowledgement — Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift:1344
    The client sends an authority-bearing management request to a queue that removes records before the client can persist or acknowledge receipt, leaving an unrecoverable failure window.
    Confidence: 0.99

What I checked:

  • Destructive dequeue has no acknowledged delivery: The collector calls the destructive queue operation before it can persist the returned records to the pending journal; a process or transport failure in that interval permanently loses attribution telemetry. (Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift:1344, 7dd482e5dd9d)
  • Upstream protocol limitation is confirmed in discussion: The contributor confirms that CLIProxyAPI currently pops server-side before returning its only queue endpoint and provides no peek/ack contract: Add CLIProxyAPI cost attribution #2457 (comment).
  • Inline YAML comments break alias-section recognition: The parser compares complete trimmed section headers with exact strings before it removes inline comments, unlike scalar values; valid headers such as oauth-model-alias: # routes or codex: # routes are skipped. (Sources/CodexBarCore/CLIProxyAPIAttributionResolver.swift:667, 7dd482e5dd9d)
  • PR scope is substantial: The verified introduced delta changes 68 files: production +6,359/-537 and tests +8,763/-149, including new telemetry persistence and credential-handling code. (7dd482e5dd9d)
  • Current-main area routing: Recent default-branch cost and spend work is concentrated in commits by Peter Steinberger and Yuxin Qiao, including spend-reporting and cost-scan changes. (Sources/CodexBarCore/CostUsageFetcher.swift, 8afdbcb1ed87)

Likely related people:

  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • Yuxin-Qiao: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Obtain or wait for a CLIProxyAPI peek-and-ack delivery contract, then prove a crash-safe acknowledged collection path.
  • Normalize commented YAML section headers and add a focused regression test.
  • Post redacted configured after-fix evidence showing collection through attributed dashboard or export output; update the PR body for a fresh review.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (164 earlier review cycles; latest 8 shown)
  • reviewed 2026-08-28T15:28:24.775Z sha b7bced9 :: needs real behavior proof before merge. :: [P2] Move catch-up guard checks off the main actor | [P2] Accumulate priced request counts in merged reports
  • reviewed 2026-08-28T16:06:52.195Z sha 09421d6 :: needs real behavior proof before merge. :: none
  • reviewed 2026-08-30T02:06:58.724Z sha 5c6c59d :: needs real behavior proof before merge. :: none
  • reviewed 2026-08-30T14:18:24.192Z sha 29d4288 :: needs real behavior proof before merge. :: [P1] Avoid destructive queue reads without durable acknowledgement
  • reviewed 2026-08-31T02:05:35.380Z sha a66dbab :: needs real behavior proof before merge. :: [P1] Require acknowledged delivery before destructive queue reads | [P2] Classify qualified foreign models by their resolved provider
  • reviewed 2026-08-31T03:18:19.765Z sha dea4da1 :: needs real behavior proof before merge. :: [P1] Require acknowledged delivery before destructive queue reads | [P2] Resolve ambiguous catalog ownership before choosing OpenAI | [P2] Make rollback credential restoration crash-safe
  • reviewed 2026-08-31T03:32:25.289Z sha 5576aeb :: needs real behavior proof before merge. :: [P1] Require acknowledged delivery before destructive queue reads
  • reviewed 2026-08-31T03:42:33.927Z sha 5576aeb :: needs real behavior proof before merge. :: [P1] Avoid destructive dequeue without acknowledged delivery

Copy link
Copy Markdown
Contributor Author

@codex review

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 27, 2026

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c3bedb05f8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/CostUsageFetcher.swift Outdated
Comment thread Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift Outdated
Comment thread Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift Outdated

Copy link
Copy Markdown
Contributor Author

Follow-up fixes are pushed in 0f4bda0 and the three current review threads have been addressed.

@codex review
@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 27, 2026

Copy link
Copy Markdown

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0f4bda0d9a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift Outdated

Copy link
Copy Markdown
Contributor Author

The current-head retention finding is fixed in e9b111e and its review thread is addressed.

@codex review
@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 27, 2026

Copy link
Copy Markdown

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9b111ef6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/CLIProxyAPIAttributionResolver.swift Outdated
Comment thread Sources/CodexBar/SpendDashboardController.swift Outdated
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jul 27, 2026
@EClinick

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@clawsweeper

clawsweeper Bot commented Jul 27, 2026

Copy link
Copy Markdown

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 29d4288bf7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a66dbab000

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 37cf61dd7e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/Vendored/CostUsage/CostUsagePricing+ModelProvider.swift Outdated
@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dea4da155b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/CLIProxyAPIUsageTelemetry.swift
@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@EClinick

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Aug 31, 2026

Copy link
Copy Markdown

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 5576aeb044

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f610e5a77f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+Claude.swift Outdated
@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@EClinick

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Aug 31, 2026

Copy link
Copy Markdown

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7dd482e5dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Sources/CodexBarCore/CLIProxyAPIAttributionResolver.swift Outdated
@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4443b51e8d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

guard line.first?.isWhitespace != true else { return false }
let trimmed = line.trimmingCharacters(in: .whitespacesAndNewlines)
guard !trimmed.hasPrefix("#") else { return false }
return conflictingKeys.contains { trimmed.hasPrefix("\($0):") }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Ignore empty upstream lists when resolving Codex OAuth

When a valid config contains an empty root list such as codex-api-key: [] or openai-compatibility: [], this presence-only check reports a competing upstream even though none exists. For historical requests that have a matching request log and a sole Codex OAuth auth file but no retained queue telemetry, authInventoryUpstream then refuses to identify Codex; the resulting route has no upstream and is excluded from both the Claude and Codex projections. Parse whether either list actually contains an active entry before suppressing the OAuth inventory fallback.

Useful? React with 👍 / 👎.

@EClinick

Copy link
Copy Markdown
Contributor Author

@codex review

@clawsweeper

clawsweeper Bot commented Aug 31, 2026

Copy link
Copy Markdown

ClawSweeper status: review started.

I am starting a fresh review of this pull request: Add CLIProxyAPI cost attribution This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 760bc3d747

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 other 🚨 Merging this PR has meaningful risk outside the owned taxonomy. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. P2 Normal priority bug or improvement with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants