Add Bailian CLI token plan usage source

[Hek846]

Summary

• add a Bailian CLI quota fetcher using bl usage token-plan --output json
• add Auto (browser cookies → CLI), CLI, and Web source modes
• preserve existing browser-cookie-first behavior for current Auto users
• map the existing Alibaba region setting to the CLI console region/site arguments
• parse the 5-hour and weekly windows independently
• add settings persistence, source labels, and parser/routing/UI tests

Compatibility and safety

Auto keeps the existing browser-cookie path first and falls back to the signed-in Bailian CLI only when Web fails. Explicit CLI and Web modes remain strict.

The CLI is invoked with an argv array through the existing bounded subprocess runner, with a 15-second timeout and a 64 KiB output cap. Only the four documented quota/reset fields are parsed. Missing CLI, authentication, network, and unsupported-output failures remain sanitized without exposing raw diagnostics or CLI configuration.

Task cancellation remains cancellation rather than being surfaced as an authentication error.

Redacted real behavior proof

Environment: signed-in domestic Personal Token Plan account, cn-beijing, Bailian CLI 1.16.0. An upgrade to 1.17.0 was attempted, but npm refused to overwrite an existing ~/.local/bin/bl; no files or credentials were changed by that attempt.

Command:

bl usage token-plan \
  --console-region cn-beijing \
  --console-site domestic \
  --output json

Redacted observed shape:

{
  "per5HourPercentage": "<omitted>",
  "per5HourResetTime": "<omitted>",
  "per1WeekPercentage": "<number>",
  "per1WeekResetTime": "<number>"
}

This confirms the real CLI may return either window independently.

The built CodexBar CLI consumed the same signed-in session:

.build/debug/CodexBarCLI usage \
  --provider alibaba-token-plan \
  --source cli \
  --format json

Redacted result:

{
  "provider": "alibabatokenplan",
  "source": "cli",
  "primaryPresent": false,
  "secondary": {
    "usedPercent": "<redacted-number>",
    "resetsAt": "<redacted-ISO8601>",
    "windowMinutes": 10080
  }
}

A second real run with --source auto resolved to source: "cli" with a valid secondary window, demonstrating browser-first Auto successfully falling through to the CLI source on this setup. Focused routing coverage asserts the ordered strategies are Web → CLI and that Web falls back only in Auto mode.

Validation

• make check
• swift test --filter AlibabaTokenPlan — 58 tests in 9 suites passed
• full make test during implementation — 906 selections across 76 groups passed
• git diff --check

Closes #3020

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: found issues before merge. Reviewed August 25, 2026, 8:16 PM ET / August 26, 2026, 00:16 UTC.

ClawSweeper review

What this changes

This PR adds Bailian CLI usage retrieval, CLI/Web source selection, bounded subprocess parsing, tests, and documentation for the Alibaba Token Plan provider.

Merge readiness

⚠️ Needs maintainer review before merge - 4 items remain

Keep open, but do not merge until a maintainer confirms the upgrade policy: existing Alibaba Token Plan configurations without a saved source now run the signed-in Bailian CLI before their established browser-cookie source.

Priority: P2
Reviewed head: 7bbec27b9aa141e4769f7b2edd2d14fd7a75645c
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Runtime evidence is strong, but the unresolved stored-settings migration is a merge-blocking compatibility concern.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The PR body provides redacted after-fix output from the real signed-in CLI and built CodexBar CLI, including an Auto fallback result.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR body provides redacted after-fix output from the real signed-in CLI and built CodexBar CLI, including an Auto fallback result.
Evidence reviewed	5 items	Existing behavior and proposed change: The base implementation handled Auto and Web through the browser-cookie strategy; the PR changes Auto to return CLI before Web. Unset configuration follows the changed route: A missing persisted source is read as Auto, and the added regression test explicitly expects the resulting legacy route to be CLI then Web. Prior blocker remains on the final head: The prior ClawSweeper review identified this same unset-source compatibility issue; the final head only adds unrelated pricing-test isolation after that review, while blame attributes the current routing lines to the checked-out PR head.
Findings	1 actionable finding	[P1] Preserve browser-only behavior for unset source
Security	None	None.

Live Verification

Command: swift run CodexBarCLI usage --help

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.24.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.24.0.tgz

Assertions:

• FAIL expect_output: --source

How this fits together

The Alibaba Token Plan provider selects a credential source, fetches quota windows, and publishes the normalized result to CodexBar’s menu bar and command-line output. Persisted provider settings determine whether it uses browser cookies or the locally signed-in Bailian CLI.

flowchart LR
A[Saved provider settings] --> B[Source-mode resolution]
B --> C[Bailian CLI]
B --> D[Browser cookies]
C --> E[Quota parser]
D --> E
E --> F[Usage snapshot]
F --> G[Menu bar and CLI]

Loading

Decision needed

Question	Recommendation
Should an existing Alibaba Token Plan configuration with no persisted source be migrated to CLI-first Auto, or retain its browser-cookie-only behavior until the user opts in?	Preserve legacy Web behavior: Treat an absent source as Web and persist/use Auto only after an explicit user selection.

Why: The branch deliberately codifies CLI-first routing for legacy configurations, while the prior behavior and PR compatibility claim point to browser-first behavior; this is an upgrade-policy choice rather than a parser repair.

Before merge

• Preserve browser-only behavior for unset source (P1) - A missing persisted source resolves to .auto, and this route now invokes bl before the browser strategy. Existing configurations had no source because current main only supported Web, so upgrade can silently switch account/auth source despite the PR’s compatibility claim. Keep absent values on Web or add an explicit approved migration with upgrade coverage.
• Resolve merge risk (P1) - Upgrading a configuration with no saved source silently starts a local bl subprocess and may show quota from that CLI session instead of the browser-cookie account the user previously configured.
• Complete next step (P2) - A maintainer must decide the permanent upgrade contract for persisted configurations without a source before a mechanical repair can be selected.

Findings

• [P1] Preserve browser-only behavior for unset source — Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift:123

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Code and test delta	production +272/-12, tests +457/-25, 13 files affected	The implementation is substantially test-covered, but the stored-source default changes upgrade behavior across app and CLI paths.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3020
Summary: This PR is the active candidate implementation for the linked Bailian CLI quota-source request.

Members:

• canonical: Bailian CLI exposes Token Plan quota via bl usage token-plan #3020 - The PR explicitly closes and implements the requested Bailian CLI usage source.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Restore opt-in CLI routing (recommended)
   Make configurations without source retain Web routing and add regression coverage distinguishing them from explicit Auto.
2. Approve an explicit migration
   Retain CLI-first legacy routing only after documenting the account-source change and proving upgrade behavior for users with both sessions.

Technical review

Best possible solution:

Keep absent source values on the established Web path, and reserve CLI-first Auto for an explicit user choice; alternatively, land an intentional, documented migration only after maintainer approval and upgrade-account proof.

Do we have a high-confidence way to reproduce the issue?

Yes: a provider configuration without source resolves to Auto, and current source then orders CLI before Web; the new test directly asserts that route.

Is this the best way to solve the issue?

No as submitted: the CLI implementation is bounded and evidenced, but changing saved legacy behavior needs either an opt-in compatibility path or an explicitly approved migration.

Full review comments:

• [P1] Preserve browser-only behavior for unset source — Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift:123
  A missing persisted source resolves to .auto, and this route now invokes bl before the browser strategy. Existing configurations had no source because current main only supported Web, so upgrade can silently switch account/auth source despite the PR’s compatibility claim. Keep absent values on Web or add an explicit approved migration with upgrade coverage.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 26132179a00a.

Labels

Label changes:

• remove merge-risk: 🚨 security-boundary: Current PR review merge-risk labels are merge-risk: 🚨 compatibility, merge-risk: 🚨 auth-provider.

Label justifications:

• P2: This is a bounded provider upgrade-compatibility blocker rather than a core-runtime outage.
• merge-risk: 🚨 compatibility: Existing configurations omit the new source field and therefore change from Web-only retrieval to CLI-first retrieval after upgrade.
• merge-risk: 🚨 auth-provider: The new default can select a different signed-in credential source from the one an existing user configured through browser cookies.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR body provides redacted after-fix output from the real signed-in CLI and built CodexBar CLI, including an Auto fallback result.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides redacted after-fix output from the real signed-in CLI and built CodexBar CLI, including an Auto fallback result.

Evidence

What I checked:

• Existing behavior and proposed change: The base implementation handled Auto and Web through the browser-cookie strategy; the PR changes Auto to return CLI before Web. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift:123, 7bbec27b9aa1)
• Unset configuration follows the changed route: A missing persisted source is read as Auto, and the added regression test explicitly expects the resulting legacy route to be CLI then Web. (Sources/CodexBar/Providers/Alibaba/AlibabaTokenPlanSettingsStore.swift:6, 7bbec27b9aa1)
• Prior blocker remains on the final head: The prior ClawSweeper review identified this same unset-source compatibility issue; the final head only adds unrelated pricing-test isolation after that review, while blame attributes the current routing lines to the checked-out PR head. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift:123, 7bbec27b9aa1)
• Real behavior evidence: The PR body contains redacted output from a signed-in Bailian CLI run, a built CodexBar CLI run using the CLI source, and an Auto fallback run. (7bbec27b9aa1)
• Repository policy: The full root policy was read and its focused-provider-test and no-unrequested-live-credential guidance informed this static review. (AGENTS.md:1, 7bbec27b9aa1)

Likely related people:

• steipete: Authored the current PR-head commit and the supplied PR history attributes the final source-default changes to this contributor. (role: recent area contributor; confidence: high; commits: d79dc6fd092a, 13929d4e7754, 7bbec27b9aa1; files: Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift, Sources/CodexBar/Providers/Alibaba/AlibabaTokenPlanSettingsStore.swift)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain a maintainer decision on the unset-source upgrade contract.
• Add a regression test for the approved legacy-versus-explicit-Auto behavior.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-08-19T21:49:49.390Z sha d7dd4b8 :: needs real behavior proof before merge. :: [P1] Preserve the existing Auto source order
• reviewed 2026-08-20T00:49:59.574Z sha 1f7ab22 :: found issues before merge. :: [P1] Allowlist the environment sent to Bailian CLI | [P1] Preserve existing Auto semantics until users opt in
• reviewed 2026-08-21T19:43:01.606Z sha 7ea2e12 :: needs maintainer review before merge. :: none
• reviewed 2026-08-25T23:39:50.080Z sha 13929d4 :: found issues before merge. :: [P1] Keep CLI routing opt-in for legacy settings

[Hek846]

Addressed the compatibility finding in commit 1f7ab22:

• Auto now preserves the existing browser-cookie-first order and falls back to Bailian CLI only when Web fails.
• Explicit Web and CLI modes remain strict.
• Focused routing coverage verifies Web → CLI and Auto-only fallback.
• The PR body now includes redacted proof from a real signed-in bl usage token-plan run, successful CodexBar explicit CLI parsing, and a successful real Auto fallback to CLI.

All 58 Alibaba Token Plan tests and make check pass.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[Hek846]

Addressed the two blocking review points in 7ea2e12a:

• The Bailian bl subprocess now receives a strict allowlist (PATH/HOME, locale/timezone, and proxy variables); ambient cookies, API keys, cloud credentials, CI variables, and other secrets are excluded.
• Legacy Alibaba Token Plan configs with an unset source remain Web-only in both the app and CLI. Explicitly selecting Auto is persisted as .auto and opts into Web → CLI fallback.
• Added unit and real stub-subprocess coverage for environment isolation, plus app/settings/CLI regression coverage for legacy versus explicit Auto behavior.

Validation:

• make check — passed (0 violations)
• make test — all 906 selections across 76 groups passed; 0 retries/failures
• Qwen implemented the change; Claude independently reviewed the six-file diff and found no merge blockers.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[steipete]

Landed as c2eff4c with the maintainer-requested automatic source order restored: signed-in Bailian CLI first, then browser/manual cookies; explicit CLI and Web remain strict. Added live isolated subprocess proof for regional argv, both quota/reset windows, sanitized child environment and cancellation, plus real provider-pipeline fallback to scoped manual cookies. Also fixed pre-existing priority-pricing tests that depended on ambient models.dev caches and caused the first hosted run to fail. Final proof: 933 local selections across 78 groups, zero failures/retries/timeouts; lint, architecture gate, independent review, and hosted CI passed. Thanks @Hek846!