Fix GitHub Enterprise Copilot tracking - #3341
Merged
steipete merged 110 commits intoSep 7, 2026
Merged
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
merge-risk: 🚨 auth-provider
|
Codex review: blocked before merge. Reviewed September 7, 2026, 4:43 PM ET / 20:43 UTC. ClawSweeper reviewWhat this changesRoutes Copilot Enterprise sign-in identity requests to the configured host, separates saved identities by host, rejects stale login writes, and skips public GitHub budget enrichment for Enterprise accounts. Merge readiness⛔ Blocked before merge - 2 items remain Still necessary: current main and v0.56.8 retain the public-only identity endpoint. The focused replacement preserves the related merged identity fix, and no blocking correctness defect was found. Priority: P2 Review scores
Verification
How this fits togetherCodexBar’s Copilot provider turns GitHub device authorization into saved accounts and quota displays. Host configuration controls network requests, while verified identity controls which saved account a login updates. flowchart TD
A[Configured GitHub host] --> B[Device authorization]
B --> C[Identity and quota requests]
C --> D[Match host and user ID]
D --> E[Check cancellation and settings revision]
E --> F[Save account]
C --> G[Quota display]
G --> H[Public GitHub budget extras only]
Before merge
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Retain the shared host resolver and guarded account writes, with the documented reauthentication boundary for unidentified Enterprise entries. Do we have a high-confidence way to reproduce the issue? Yes, from source: configure an Enterprise host and initiate sign-in; current main sends identity lookup to api.github.com while authorization and quota use Enterprise endpoints. No runtime reproduction was executed. Is this the best way to solve the issue? Yes. Reusing the existing host resolver fixes the mismatch, while issuer-qualified matching and revision checks protect saved accounts without adding configuration. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against d85ef4935d7e. LabelsLabel justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
History |
Contributor
Author
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
proof: sufficient
…#3343) ## Summary Fix intermittent process-containment failures when `make check` runs inside `ci_swift_test_by_suite.run_command`. A nested runner can still own its fixture's unreaped wait handle while macOS hides the exited session leader's metadata from an outer observer. The outer runner previously treated that temporary missing anchor as an immediate failure, interrupting the inner owner's cleanup. Separate ordinary observation from strict cleanup. While its direct command remains running and wait-owned, an observer retains unresolved identities as pending without adopting or signaling them. Pending births and observed descendants remain tracked across reparenting, session migration, and parent exit. Command exit and cleanup still reject unresolved uncertainty; replaced owned session-leader births and unreadable required metadata still fail closed. Add a deterministic nested regression that forces the exact missing-anchor observation order, plus pending-descendant, PID-replacement, metadata-error, and no-signal safety tests. Update the development guide to describe the ownership boundary. ## Validation - The gated nested regression reproduces the original `Lost test session continuity ... cannot attribute PIDs ...` failure against the original runner. - Final synthetic cleanup suite, inside a real outer runner: 95 tests successful in 35.590 seconds on macOS 27 / Python 3.14.7, with one existing Linux-native pthread test skipped on macOS. Owned children are drained, the inner failure retains exit code 23, and unrelated sentinels survive. - Exact `run_command(['make', 'check'], timeout=180)` succeeded in 69.885 seconds in an isolated checkout, including another complete cleanup-suite run and zero SwiftLint violations. Verified source hashes match this patch. - Native Darwin audit-token fixtures preserve wrong-generation children, then terminate and reap matching identities while unrelated sentinels survive. - 72 selected synthetic safety tests passed with zero skips. `git diff --check` is clean. Local verification limitations are explicit: the primary workstation had prolonged filesystem/startup stalls. Local wrapped checks exhausted their unchanged 180-second deadline before the containment fixture, and the full local Swift build was stopped while stalled. No full local Swift-suite pass is claimed. ## Safety and scope PID birth checks, generation-bound signaling, direct-child wait ownership, cleanup grace periods, fixture budgets, and command deadlines are unchanged. Pending status never grants signal authority. No fixture was disabled, and no app/provider/metadata-performance implementation is changed. The tracker still cannot discover ancestry that disappears entirely between snapshots. ## Final CI outcome CI run 33469117913, attempt 2, passed on the unchanged reviewed head 344d588. Both macOS shards, Linux glibc x64 and ARM64, lint, change detection, and lint-build-test succeeded. The musl build was skipped under the existing path gate; GitGuardian passed. The initial run failed only an unchanged renderer timing assertion in MenuBarLayoutRendererTests.swift:502: the fastest cached batch measured 56.409875 ms against the existing 50 ms limit. One failed-job rerun passed without changing source, fixtures, assertions, grace periods, or deadlines. CI: https://github.com/steipete/CodexBar/actions/runs/33469117913
) Accept a Grok billing parser's implicit zero only when a complete single response establishes an active current usage period. Preserve provenance through enrichment so malformed, inactive, and arbitrary inferred zero responses remain unavailable. Fixes steipete#3261. Co-authored-by: sf-jin-ku <jin.ku@sendbird.com> Co-authored-by: olddonkey <olddonkeyblog@gmail.com>
Preserve the 5,000 ms production SQLite busy timeout while allowing the four deliberate lock-contention fixtures to use 25 ms. The tests still hold real writer locks and verify retry, preservation, recovery, and default configuration. Fixes steipete#3334. Co-authored-by: Nikolai Berezovskii <nikolai@brzv.sk>
* perf: skip discarded JSONL tail-state tracking * test: isolate Linux pipe-capture close timing * test: yield between JSONL differential batches
…#3352) Allow scheduled browser refresh to recover when a current noninteractive Safe Storage preflight explicitly grants access. Preserve disabled-access protection, non-allowed preflight rejection, noninteractive cookie reads, and the user-initiated denial cooldown. Fixes steipete#3287.
Recognize confirmed legacy Keychain ACL rejection and share one bounded five-minute retry deadline across reads, writes, clears, and display. Keep temporary and indeterminate validation failures retryable, and recover after external repair without restarting. Fixes steipete#3300. Co-authored-by: Igor Khramtsov <igor.khramtsov@proton.me>
Disambiguate colliding Codex workspace labels in the visible-account projection with stable identity suffixes. Keep those suffixes readable in crowded account switchers and preserve identity across active/system-account promotion. Fixes steipete#3282.
Restore the existing Ollama quota path for monthly included-credit pages while preserving legacy quotas and stored history. Keep menu, CLI, widget, and history projections aligned with the reported billing period. Harden dollar parsing and cover history transitions, mixed windows, widget labels, and native rendering with focused regressions and synthetic proof. Co-authored-by: haixing23 <179552153+haixing23@users.noreply.github.com>
…e#3357) Reject invalid protobuf field numbers and overflowing varints before a billing response can qualify as a complete implicit-zero reading. Restrict recursion to schema-declared billing messages so valid opaque fields cannot invalidate the response or invent usage and reset values. Preserve error propagation through known nested messages and existing flat/captured billing fixtures. Add regression coverage for malformed tags, legal scalar boundaries, opaque byte fields, all known nested message paths, and historical timestamps. Update provider documentation and changelog.
Attach minor and maintenance badges to the actual prominent single-quota layout instead of the former lower lane. Preserve dual and reserved lanes, credits-only layouts, and severe-status glyphs. Add primary/secondary and visible-glyph regression coverage, plus a 120-case synthetic pixel matrix. Regenerate and verify before/after proof, preserve contributor credit, and update the changelog and documentation. Co-authored-by: songdechao <songdechao@bytedance.com>
Reject NaN and infinite saved status-item positions at the existing placement preflight before AppKit restores them. Preserve finite values, display-bound policy, unrelated saved positions, and matching legacy-key ownership. Add isolated defaults-backed regressions and document the placement validation boundary. Found during investigation of steipete#3355; this does not fix or close that separate finite-position recurrence. Proof: baseline regression fails as expected; 65 integrated focused tests and make check pass; scoped Codex autoreview and maintainer review have no accepted findings. Exact-head CI 33537432141 passes complete macOS shards, Linux tests/builds, plugin-engine goldens, lint, and aggregate gate. The local full suite did not pass under host filesystem contention; the complete hosted suite is the merge gate. Release-note context: discard invalid non-finite saved menu-bar positions while preserving valid placements. Changelog generation belongs to release time.
Move unchanged synthetic fixture construction outside cached-render timing, matching the production ownership boundary. Retain the 50 ms limit, three batches of 1000 full render calls, and attributed-title identity assertion. Add deterministic cache-work, usage-invalidation, and cache-clear coverage. No production behavior changes; separate from containment PR steipete#3343. Proof: baseline renderer 50 tests and corrected renderer 51 tests passed; pinned scoped formatting/lint and diff --check passed. Only comments changed after the final test run. Completed isolated review is scoped-clean. Local make check stopped on unrelated MiMo Python 3.9 fault injection. Local full make test was withheld because app-group migration tests can reach real user snapshots. Isolated CI must pass before landing.
…teipete#3453) Retain account-scoped quota-warning episodes across Claude credential invalidation instead of treating the next observation as a new threshold crossing. Keep retiring unknown-owner state and preserve all credential, snapshot, and account-mismatch cleanup. Simplify provider/window warning retirement with one dictionary filter; production code is net -1 line. The real refresh-path regression with synthetic credentials reproduced five warnings instead of three on main for both active-account and OAuth-owner identities. The fix preserves recovery crossings, lower thresholds, and independent account/provider state. Verified 150 focused tests, all 1,027 selections in 86 full-suite groups without retries, formatting/lint, architecture anchors, independent review, and exact-head CI. Refs steipete#3450. This fixes a proven repeated-invalidation path; leave the report open for confirmation and unresolved ownership changes. Thanks @JonLaliberte for the report.
) Validate the combined nonnegative input/output Activity token total before publishing the optional history snapshot. This prevents Swift mapping failures from hiding otherwise valid credits and key quota, and replaces redundant component checks. Extracted from steipete#3272; the separate Management API key contract remains unchanged. Native QuickJS and JavaScriptCore baseline failures become balance-preserving results, including exact safe-integer-boundary coverage. Full make test passes all 1,027 selections / 86 groups without retries or timeouts; make check passes. Co-authored-by: Akshay Prabhu <12824090+akshayprabhu200@users.noreply.github.com>
…e#3459) Translate the complete model-weekly phrase at the menu presentation boundary while preserving provider model names, canonical snapshot/CLI titles, percentages and other providers. Add all 23 catalogs and correct swapped Vietnamese weekly/missing-version labels. Fixes steipete#3447. Thanks @gianpaj for the report and implementation pointers. The +29 production lines are funded by the already-landed -40-line menu cleanup in steipete#3456, leaving those two PRs at -11 production lines combined. Synthetic native before/after screenshots and focused tests cover the actual menu-card presentation. The opt-in screenshot fixture requires credential/session isolation and skips ordinary test runs. Full make test passed all 1,028 selections / 86 groups without retries or timeouts after the old menu expectations were corrected; make check passed.
…#3460) Verified GitHub IDs outrank mutable login/display labels when resolving legacy token accounts. Retain unresolved label fallback only after searching all verified matches. The matching regression reproduces two wrong-account selections on baseline; focused tests, make check, full 1,028-selection suite and exact-head CI pass. This does not resolve Enterprise routing in steipete#3341.
…te#3461) Select upstream CloudKit provisioning only for its resolved signing team, and share the resolved bundle ID when deriving app/widget groups. Extracted from steipete#3372. Sixteen actual entitlement/profile-selection configurations, existing signing checks, make check, full 1,028-selection suite and exact-head CI pass. Direct alternate identity discovery remains separate. Co-authored-by: Juanito <krazybean@gmail.com>
…eipete#3465) Quota settings duplicate the existing Session label under a separate localization key. Reuse the canonical key and remove the redundant entry from all 23 catalogs. Every removed value was compared byte-for-byte with its existing Session translation before and after the change; all 23 match. This is a behavior-preserving cleanup removing 23 production lines. It supplies the deletion budget for z.ai's shared native detail-label validation so valid Unicode labels retain the existing framework rules. Validation: make check passed; the full 1,028-selection / 86-group suite passed on the first pass without retries or timeouts (885.7 seconds). Isolated P2 autoreview, supplied the exact translation-pair evidence, found no actionable findings. Exact-head CI will be recorded before merge.
…3463) Startup validation could discard a valid saved position when a wide display sits left of the primary screen: its global right edge underestimated the usable width. A 2,500-point position on a 3,840-point left-hand display could be cleared. Raise the bound to cover screen width while retaining the complete range accepted by the old global-right-edge calculation. This preserves existing menu-manager parking positions, including 6,247 on a rightward dual-display arrangement. Simplify the finite-positive value guard. Production code decreases by three lines. The initial width-only proposal tightened the range on rightward layouts. Review caught that compatibility risk, and the final policy is monotonic: it cannot reject any finite positive position the previous policy accepted. Geometry tests cover four arrangements, missing displays, and preservation against the old bound. All 70 focused tests pass; `make check` passes and independent review is clean. The full `make test` suite also passes against the narrowed revision (1,028 selections across 86 groups; no retries). Related to steipete#3355; that issue remains open because these tests establish startup geometry validation, not the reported post-launch recurrence. No live menu-position repair is claimed. Changelog and development documentation are updated.
…teipete#3466) HTTP 403 from Codex OAuth and PAT endpoints was treated as expired authentication. In Auto mode this could trigger CLI recovery for a permission denial. Preserve the status and response body as a terminal server error; HTTP 401 retains authentication recovery. Share request status, network-error, and cancellation handling across usage, reset-credit, spend-control, and PAT requests. Requests and decoding contracts remain unchanged. Production code decreases by 64 lines. The actual fetcher-to-pipeline regression failed before the change, including Auto selecting the CLI fallback sentinel. All 93 focused tests across five suites pass, covering OAuth/PAT endpoints, 401 controls, and terminal 403 behavior. `make check` and the full `make test` suite pass (1,028 selections across 86 groups; no retries). Independent review found no actionable P0–P2 findings. Tests use synthetic responses; no live account access is claimed. This extracts the status distinction discussed in steipete#3379; the broader managed credential renewal work remains open. Thanks @Yuxin-Qiao for that work. Changelog and OAuth documentation are updated. Co-authored-by: Yuxin Qiao <104957188+Yuxin-Qiao@users.noreply.github.com>
…te#3468) Both automatic Codex catch-up workers ignored the app's Low Power Mode preference when scheduling successive local-usage passes. The initial two-second AC budget produced a 1,998-second delay and concealed the gap; a later 100ms pass scheduled another scan after only 99.9 seconds. Share the resource-decision helper between usage and Spend Dashboard, then apply the existing 30-minute app interval only to automatic run delays. Preserve longer delays, explicit accelerated scanning, physical Low Power Mode and thermal pauses, and target duty cycles. The setting applies to subsequent scheduling decisions; it does not replan an existing sleep. The synthetic 100ms regression failed across AC, battery, and unknown power sources before the clamp. All 47 focused tests across three suites pass, including successive-pass integration for both workers, acceleration controls, and existing thermal/no-progress behavior. `make check` passes and independent review is clean. The initial full run caught ten stale architecture-test line anchors after the helper extraction. Their unchanged source anchors were verified and the line references updated without adding exceptions; all 88 focused tests including the architecture gate pass. The final full `make test` suite passes all 1,028 selections across 86 groups without retries; exact-head CI must pass before landing. Production code decreases by four lines. Changelog and cadence documentation are updated. This is a narrower correction found while rechecking steipete#3257, without adopting its proposed six-hour cadence or visibility changes.
…steipete#3462) Antigravity bookkeeping rows without a step UUID caused the entire local history provider to be withheld as incomplete. Permit those rows after charging their row and byte budgets, while keeping malformed data and exhausted budgets as hard failures. A lone identified timestamp cannot stand for every occurrence of a reused UUID when unidentified rows are present. Rows without UUIDs can still carry bot identity. Record that evidence before skipping UUID positioning: a duplicate bot ID with unknown UUID permanently invalidates exact and positional matches, regardless of scan order, matching timestamps, or absent timestamps. This addresses the review finding on the original revision. Keep ambiguous positional slots intact so later timestamps never move into them. Share the identical step-occurrence structs, remove an unused counts projection, and apply positional ambiguity during timestamp selection. The final PR reduces production code by four lines. Token counts, pricing, credentials, discovery roots, and stored data remain unchanged. Changelog and documentation are updated; thanks @urda. Maintainer validation: six synthetic duplicate-bot combinations failed 18 assertions on the original PR and pass after repair. All 406 focused Antigravity tests across 34 suites pass, including harmless bookkeeping, reused UUIDs, embedded timestamps, malformed rows, and budgets. `make check` passes and independent review is clean. The full `make test` suite passed all 1,028 selections across 86 groups without retries. The main integration preserves the tested Antigravity source, tests, and documentation byte-for-byte; integration `make check` also passes. Exact-head CI must pass before merge. Contributor live evidence, collected on the original proposal: @urda compared the shipped 0.56.6 CLI and a rebuilt CLI against the same 211 stable local session databases from agy 1.1.27, using read-only scratch copies with WAL sidecars. Complete coverage increased from 208 to 211; the three recovered sessions contained 80,067, 48,183, and 5,299,395 tokens. Removing UUID-less bookkeeping rows from copies also made the shipped CLI return complete coverage, isolating the original cause. One previously passing session's output, excluding updatedAt, matched byte-for-byte. Three actively written sessions were excluded because both binaries reported them incomplete until checkpointing. This is contributor-reported live evidence; the maintainer's final ambiguity repair uses synthetic native SQLite fixtures. This builds on steipete#3266, steipete#3396, and steipete#3403. It is distinct from steipete#3412's cost-estimation changes. Earlier proposal steipete#3451 remains related; no unrelated issue is claimed resolved. Co-authored-by: Peter Urda <peter.urda@gmail.com>
…3464) Claude transcript inventory detected atomic file replacement, but the scanner discarded file identity and treated a larger replacement as an append. A normal refresh could merge stale rows with the new suffix: the baseline fixture reported 1,017 input tokens where a full rescan correctly reported 24, across warm and cold loads. Match persisted device/inode identity before reusing rows or a parse offset. Store identities atomically with rows in the Claude/Vertex JSON artifact, preserving its existing flat format. Missing legacy identities trigger one rebuild before reuse, including during refresh debounce. Consolidate full and incremental parsing into one path and prune identities alongside removed files. Review caught a cross-provider compatibility problem in the initial shared-model approach. The final implementation leaves both the shared cache model and generated Codex parser fingerprint byte-identical to main and v0.56.7. The generator runs unchanged; no allowlist, hand-edited fingerprint, or unrelated Codex/Pi cache reset is introduced. CI initially caught one timestamp-test adapter line omitted from the commit despite being present in the passing local tree. That line is now included, its four focused timestamp tests pass, and the committed tree matches the complete local candidate. All 118 focused tests across four suites pass: warm/cold larger replacements, same-size/same-mtime replacement, actual incremental append, flat legacy-cache upgrade within debounce, empty parsed rows and pruning, released Codex row/checkpoint retention, and released Pi pricing-key reuse. `make check` passes and independent review is clean. The full `make test` suite also passes against the final isolated-cache revision: 1,028 selections across 86 groups, no retries. Production code grows by 14 lines after the parsing consolidation. This is funded by nine remaining lines from separate cleanup steipete#3465 and five of the eleven remaining lines from steipete#3456; steipete#3465 landed as debe5cd. Changelog and Claude documentation are updated, including the literal-directory meaning of `CLAUDE_CONFIG_DIR`. Related investigation: steipete#3209 remains open. These filesystem fixtures prove transcript replacement handling, not that this is the reporter's specific cause. Arbitrary same-inode prefix rewrites are outside this fix.
…pete#3469) The config watcher could miss a rapid atomic replacement made while its old file descriptor was being retired. It also kept an app-written content hash indefinitely, suppressing an external edit that restored those bytes after another external change. These failures leave running settings stale and can prevent the affected provider from being queued for sync. Rearm immediately after rename/delete and reread after installing the new source. Track observed contents rather than a permanent app-write marker. Successful app writes and their observed baseline now commit under the same lock used for event reads, while change callbacks run outside the lock. Existing file watching still detects in-place edits; encoding and the detached persistence boundary stay unchanged. Writes still execute when the watcher is absent or stopped, and failed writes do not advance the baseline. Native filesystem regressions reproduced both missing updates on the old implementation. The original Cloud Sync file-edit integration test failed in that baseline run too. Its complete event-to-sync path remains intact; after a full-suite timing retry, the redundant setup write/sleep was removed and its polling uses a bounded deadline plus an assertion that settings actually loaded the edit. All 63 focused tests across the Cloud Sync and architecture suites pass, covering callback-time replacement, restoring app-written content, missing-file startup, self-write suppression, failed writes, and nil/stopped watchers. `make check` passes and independent review is clean. The full suite passed all 1,028 selections across 86 groups with one integration-test group retry. After the synchronization correction, all 22 Cloud Sync tests pass without retry; production code is unchanged. Exact-head CI is required before merge. Production code increases by six lines after nearby simplification, funded by the final six unspent lines from separately landed cleanup steipete#3456. Changelog and configuration documentation are updated. Found while investigating the unrelated Cloud Sync failure in steipete#3467's CI. This fixes the watcher instead of replacing that integration test with a direct reload call.
Share Kiro's existing constructor defaults while explicitly supplying the live CLI resolver and API fetcher. Collapse the duplicated CLI overage-status fallback, preserving explicit API status and cap precedence, and remove an unused API logger. This is behavior-preserving cleanup that removes 13 production lines and funds a separate regional-enrichment bug fix. All 99 focused Kiro tests across nine suites pass, `make check` passes, and independent review is clean. The full suite passed all 86 groups in 1,812.8 seconds; two timed-out groups recovered through isolated selection retries. Exact-head CI run 34108675137 passed on macOS and Linux. No credentials or live provider requests were used.
…redentials Safe-source loading could remain stuck on an expired Claude cache even after Claude Code had already written a fresh token. Expired records skipped the existing changed-fingerprint synchronization, while Auto disabled direct repair and an unchanged CLI touch could not establish another refresh. Reuse the existing freshness check for expired CLI-owned records after file fallback, restricted to the historical default profile. The global CLI Keychain item cannot identify a custom profile. Preserve direct-read consent, stored/effective prompt policy, cooldown, pre-alert, noninteractive-read gates, and explicit file/environment precedence. Reject expired replacement credentials and derive history ownership from the adopted token. Reuse cached records internally without changing public memory-cache source labels, and flatten the existing repair condition. Production code decreases by three lines. The synthetic default-profile regression failed five assertions before the fix. All 62 focused tests across five suites pass, including 15 policy/ownership/profile/source scenarios and existing delegation and CLI ownership coverage. `make check` and independent review pass. The final full-suite run passed all 1,028 selections across 86 groups with no retries in 1,273.9 seconds. Exact-head CI run 34111391439 passed on macOS and Linux. An earlier local run failed subprocess fixture startup deadlines; the exact 128-test group and final full rerun passed unchanged. Disk-space warnings during the final run were cleared by deleting idle task build caches, with no assertion failures. Tests use in-memory Keychain collaborators and synthetic files; no real credentials were read or CLI credentials rewritten. Partial investigation of steipete#3390. The separate partition-ID/prompt allegation is not claimed fixed. Changelog and Claude documentation are updated. Thanks @kerloom for the report and follow-up trace.
Optional z.ai model analytics could invalidate an otherwise valid quota snapshot when the response exceeded native chart limits, contained an invalid label, or overflowed an aggregate. The existing JavaScript catch ran before native snapshot validation, so it did not contain these failures. Validate optional analytics before attaching the section and reuse normalized positive token counts. A pure native `ctx.isDetailLabel` predicate shares the exact existing Unicode grapheme and whitespace rules across QuickJS and JavaScriptCore. Invalid optional sections are omitted while primary and weekly quotas remain available; chart periods and model names are not truncated. Both native engines failed the 121-point baseline while the 120-point control passed. All 54 focused z.ai/runtime tests pass, covering chart limits, invalid whitespace and labels, finite aggregates, non-string inputs, and 120-character decomposed/emoji labels. `make check` and the full `make test` suite pass (1,028 selections across 86 groups, no retries). Independent review found no actionable P0–P2 findings. No live account probes were used. The config-watcher dependency steipete#3469 has landed. This branch is integrated with main, and its diff is now standalone. The earlier combined full suite passed all 1,028 selections across 86 groups without retries; both macOS shards and the glibc CLI matrix passed on the final commit. The static Linux SDK installer crashed in upstream Swift/OpenSSL code after downloading the SDK, before project compilation; the failed jobs passed on retry on the same commit. Final CI run 34112526311 is green, including both macOS shards and all Linux builds. The standalone z.ai change grows production code by 14 lines, funded by the separate 23-line localization cleanup in steipete#3465, landed as debe5cd. Documentation and changelog are updated. Investigation was adjacent to steipete#2522 and steipete#2871; their original reset/API-version symptoms are not claimed fixed.
Kiro's existing post-CLI overage enrichment always sent GetUsageLimits to US East, even when the CLI state selected a Frankfurt profile. Route that request using the already-read profile ARN: retain the established US East endpoint and use the documented q.eu-central-1 endpoint for Frankfurt. Use a fixed endpoint map after validating the ARN's partition, service, region, and profile resource shape. Invalid or unsupported routing state fails before transport; the existing best-effort caller retains CLI output. Preserve the bearer token source, exact profileArn body, request method/headers, timeout, cancellation, and read-only SQLite access. No API-first recovery or new credential read is introduced. The Frankfurt SQLite-to-request regression failed on the old endpoint while the US East control passed. All 29 focused tests across three suites pass, including fixed regional URLs, request metadata, unchanged database bytes, invalid ARN rejection without requests, missing credentials, cancellation, and CLI fallback. The full suite passed all 86 groups in 1,093.5 seconds, with one successful full-group retry. `make check` and independent review pass for the integration with current main; exact-head CI run 34113918209 passed on both macOS shards and every Linux build. Separate cleanup steipete#3470 has landed and removes 13 production lines. The regional fix itself adds eight lines, leaving five cleanup lines unspent. This branch now includes that landed cleanup and current main. Fixes the regional-enrichment portion of steipete#3359. Thanks @zucram for the follow-up trace and successful regional response. The change follows [AWS profile-region routing](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/firewall.html) and [supported profile regions](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-regions.html). Validation used synthetic credentials and transport responses; no live account probe was performed. Changelog and provider documentation are updated.
MiniMax billing and Overview spend tests assumed US grouping and decimal separators even though the production formatting intentionally follows the current locale. A fresh Swedish test process reproduces all three reported assertion failures; a US control passes. Keep the exact expected amounts, independently rounded 15.7M total, partial marker, suffix, units, and surrounding dashboard assertions. Derive only the expected number separators from Foundation, without calling the production compact-count helper to generate the expected total. Pair each existing compact-count divisor with its suffix in one tuple, preserving every threshold and removing one production line. All 22 focused tests across MiniMaxMenuCardBillingTests, OverviewSpendSummaryTests, and ShareStatsTests pass in fresh Swedish and US processes using launch arguments -AppleLocale sv_SE/en_US and -AppleLanguages '(en)'. Locale identifiers and representative formatted values were verified in isolated child processes. No user preferences were changed. The full local suite passed all 1,028 selections across 86 groups on the first attempt, without retries, in 882.7 seconds. `make check` passes and independent review found no actionable P0–P2 findings. Exact-head CI run 34119529398 passed, including both macOS shards and all Linux builds. Thanks @zucram for reporting the locale-dependent failures in the follow-up to steipete#3359. Production display behavior is unchanged, so no user-facing changelog entry is needed.
Codex report construction duplicates model-cost accumulation and scalar/aggregate pricing, and wraps a single catalog load in a stateful resolver. Share those paths while preserving their existing behavior. Project/session model summaries retain exactly their six cost/token fields, including nil-versus-zero semantics; activity detail remains omitted. Traversal, addition order, and caller sorting stay unchanged. Aggregate pricing still applies custom overlays before rejecting unresolved long-context aggregates. Catalog loading stays at the same point with the same supplied/loaded/empty precedence. The single-use project accumulator method becomes its two existing assignments. This removes 110 production lines and funds the separate report-pricing CPU fix in steipete#3476. The generated parser identity changes mechanically, so the released 9547dc9d7b7675f6 identity is explicitly adopted without rebuilding native rows or checkpoints. Pi's force-rescan fixture uses the current parser identity; independent predecessor-invalidation coverage remains. The focused run passed 287 tests across 11 suites covering pricing, overlays, catalog-loading work, model projection, cache adoption, Pi compatibility, fork accounting, project/session behavior and architecture. The final patch additionally checks that a custom zero-price overlay remains authoritative above the aggregate context threshold. `make check` passes and independent review found no actionable P0–P2 findings. The full local suite passed all 1,029 selections across 86 groups on the first attempt, with no retries or timeouts, in 1,276.5 seconds. Exact-head CI run 34148708994 passed both macOS shards and all Linux builds. No live accounts, credentials or user preferences were accessed by these tests. Production output is unchanged, so no user-facing changelog entry is needed for this cleanup.
Reuse bounded model resolution within each Codex daily, project, and session report while preserving scalar pricing and persisted cache compatibility. Refs steipete#3247, steipete#3411. Cleanup steipete#3479 funds this fix; the pair removes nine production lines. Changelog and contributor proof retained. Validation: 267 focused tests, full 1,031-selection suite, make check, independent P2 review, and exact-head CI 34155321823 pass. Co-authored-by: Nikolai Berezovskii <nikolai@brzv.sk>
Replace the original PR3341 implementation on current main, preserving public legacy account matching and the existing usage API version header. Guard delayed login commits with the provider revision captured before authorization; skip public budget enrichment for Enterprise accounts. Validation: 64 focused tests, 1,031 full-suite selections, make check, and independent P2 review pass. Production +13 is funded by landed cleanup; docs and changelog updated. Co-authored-by: Fletcher Alderton <109054210+Fletcher-Alderton@users.noreply.github.com>
clawsweeper
Bot
added
merge-risk: 🚨 compatibility
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enterprise device authorization and quota requests already used the configured GitHub host, but sign-in identity still went to api.github.com. This repair uses the existing API-host resolver for identity and keeps accounts with equal numeric user IDs on different hosts distinct.
Public GitHub retains its existing stable and legacy account identifiers. Enterprise sign-in requires a verified identity and matches only the same API issuer and user ID; it never probes unidentified legacy tokens or adopts an account by login/label. Public-GitHub browser budget enrichment is skipped for Enterprise quota requests. Stored identifiers remain deduplication metadata; the configured host still determines request routing.
A login captures the existing provider configuration revision before any network await and rejects changed configuration both before and after legacy matching. Account edits/removals, host changes, and cancellation therefore cannot commit a stale login. The refactor shares existing normalization and login-error handling. The usage API-version header remains unchanged because the original trace does not establish that it causes a failure.
Validation: 64 focused tests across six suites pass, including injected HTTP endpoint/headers, zero public-budget requests for Enterprise quota, public plus two Enterprise issuers with equal IDs/logins, legacy compatibility, exact reauthentication, cancellation, and account edits/removals before and during identity resolution.
make checkpasses with zero lint violations. Independent P0–P2 review is clean after fixing its delayed-revision finding. The full suite passes all 1,031 selections across 86 groups on the first attempt, with zero retries/timeouts, in 841.6 seconds. Exact-head CI 34160173751 passes macOS tests, Linux builds, lint, and security checks on 4ad9db9. The run initially required GitHub workflow approval; after verifying no workflow changes, it was approved and passed without source changes.The contributor's original redacted Enterprise trace on 7e90941 observed identity and usage HTTP 200 responses against the configured Enterprise API host. That is historical contributor evidence; the maintainer replacement is verified with synthetic transports and isolated settings, without real credential or browser-cookie probes.
Production delta: +13 lines. It is funded by the remaining nine lines from landed cleanup #3479 after pricing #3476 and four of the five previously unallocated cleanup lines. The cleanup balance remains positive. Documentation and the Unreleased changelog are updated. Thanks @Fletcher-Alderton for the original endpoint repair and Enterprise verification.