Add Helmcode usage provider

[luisgonzaleznf]

Summary

• add a Helmcode dashboard-session provider for both tenants, Helmcode Cloud and NaN Builders, with automatic tenant detection (Deployment: Automatic / Helmcode Cloud / NaN Builders), Chrome cookie import, and a manual Cookie/cURL fallback whose host is detected from a cURL capture
• show per-model monthly token quotas with each model's own reset date (periodEnd), rolling-window tiers rendered with their window length, and premium tiers hidden unless the subscription is premium; the prepaid balance is shown on Helmcode Cloud only (NaN Builders membership has none)
• persist the validated session per tenant through CookieHeaderCache so background refreshes and the bundled CLI reuse it without rereading Chrome; a rejected session evicts the entry and requires a fresh user-initiated import
• dashboard actions open the detected tenant's /dashboard; the provider icon is the official Helmcode mark
• branding, settings, provider documentation, fixtures captured from the real API shape, and tests split by seam (fetcher, settings reader, cookie header, descriptor, deployment detection, menu card, dashboard action, Linux snapshot)

Validation

• swift test --filter "Helmcode|MenuCardHelmcode|ProviderIconResources|ProviderArchitectureGatekeeper" — 94 tests in 8 suites, all passed (re-run independently by a second reviewer session)
• make check — clean (manifests, locales, packaging, script tests, swiftformat, swiftlint); swiftformat and swiftlint also clean on every changed file under TestsLinux
• make test — 1,016 selections across 85 groups, 85/85 first pass, 0 retries (run on the round-2 tip before the rebase onto origin/main; after the rebase: build, the focused suites above, and make check green; CI re-runs the full suite on this head)

Notes

Helmcode inference API keys do not expose quota or billing, so the provider reads the same authenticated endpoints the dashboards use: GET /api/usage/quota (required), GET /api/billing and GET /api/billing/credits (best-effort, fail-soft). Both tenants share the quota API; billing differs. The prepaid balance exists on Helmcode Cloud only, and /api/billing/credits answers 404 on NaN Builders, which the provider treats as "no balance for this tenant".

Live evidence (NaN Builders tenant, redacted) — head a3eac99fc

Built with swift build -c release --product CodexBarCLI at a3eac99fc. The session came from a Chrome "Copy as cURL" capture of the dashboard's own /api/usage/quota request, read from a 0600 temp file and never printed; every output file was grepped for the cookie value before posting (no match). Token counts below are real. --log-level verbose prints the credential-boundary trace: the tenant decision, then one line per request naming host, path, and credential type (and, for cached sessions, cookie names with expired or path-excluded cookies listed by name).

A. cURL capture, no HELMCODE_DEPLOYMENT — the tenant is detected from the capture's host

$ HELMCODE_COOKIE="$(cat "$TMP")" codexbar usage --provider helmcode --source web --verbose --log-level verbose --format json
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: tenant NaN Builders detected from capture host
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.nan.builders/api/usage/quota credential=header
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.nan.builders/api/billing credential=header
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.nan.builders/api/billing/credits credential=header
info com.steipete.codexbar.helmcode-usage: [CodexBarCore] No prepaid balance for this tenant (credits endpoint unavailable).
[helmcode] fetch strategies:
- helmcode.web (web) available
[
  {
    "provider": "helmcode",
    "source": "web · NaN Builders",
    "usage": {
      "dataConfidence": "exact",
      "identity": {
        "providerID": "helmcode",
        "loginMethod": "Dashboard session"
      },
      "primary": {
        "usedPercent": 12.95608925,
        "resetsAt": "2026-10-01T00:00:00Z",
        "resetDescription": "glm5.3-flash · 259,121,785 / 2,000,000,000 tokens"
      },
      "extraRateWindows": [
        {
          "title": "deepseek-v4-flash",
          "window": {
            "usedPercent": 0,
            "resetsAt": "2026-10-01T00:00:00Z"
          }
        },
        {
          "title": "mimo-v2.5",
          "window": {
            "usedPercent": 0,
            "resetsAt": "2026-10-01T00:00:00Z"
          }
        },
        {
          "title": "qwen3.8-flash",
          "window": {
            "usedPercent": 0,
            "resetsAt": "2026-10-01T00:00:00Z"
          }
        }
      ],
      "providerCost": null
    }
  }
]

B. bare Cookie header, pinned with HELMCODE_DEPLOYMENT=nanbuilders

$ HELMCODE_COOKIE="$(cat "$TMP_BARE")" HELMCODE_DEPLOYMENT=nanbuilders codexbar usage --provider helmcode --source web --verbose --log-level verbose --format json
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: tenant NaN Builders pinned
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.nan.builders/api/usage/quota credential=header
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.nan.builders/api/billing credential=header
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.nan.builders/api/billing/credits credential=header
info com.steipete.codexbar.helmcode-usage: [CodexBarCore] No prepaid balance for this tenant (credits endpoint unavailable).
[helmcode] fetch strategies:
- helmcode.web (web) available
[{"provider": "helmcode", "source": "web · NaN Builders", "usage": {"primary": {"resetsAt": "2026-10-01T00:00:00Z", "resetDescription": "glm5.3-flash · 259,121,785 / 2,000,000,000 tokens", "usedPercent": 12.95608925}, "extraRateWindows": ["deepseek-v4-flash", "mimo-v2.5", "qwen3.8-flash"]}}]

C. rejected session on NaN Builders (garbage cookie)

$ HELMCODE_COOKIE='session=garbage' HELMCODE_DEPLOYMENT=nan codexbar usage --provider helmcode --source web --verbose --log-level verbose --format json
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: tenant NaN Builders pinned
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.nan.builders/api/usage/quota credential=header
[helmcode] fetch strategies:
- helmcode.web (web) available error=NaN Builders dashboard session expired. Sign in again at cloud.nan.builders.
[{"source": "web", "error": {"message": "NaN Builders dashboard session expired. Sign in again at cloud.nan.builders.", "code": 1, "kind": "provider"}, "provider": "helmcode"}]

D. rejected session on Helmcode Cloud — each pinned tenant only ever talks to its own host

$ HELMCODE_COOKIE='session=garbage' HELMCODE_DEPLOYMENT=helmcode codexbar usage --provider helmcode --source web --verbose --log-level verbose --format json
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: tenant Helmcode Cloud pinned
debug com.steipete.codexbar.helmcode: [CodexBarCore] helmcode: GET cloud-api.helmcode.com/api/usage/quota credential=header
[helmcode] fetch strategies:
- helmcode.web (web) available error=Helmcode dashboard session expired. Sign in again at cloud.helmcode.com.
[{"provider": "helmcode", "source": "web", "error": {"kind": "provider", "code": 1, "message": "Helmcode dashboard session expired. Sign in again at cloud.helmcode.com."}}]

Packaged app (screenshots from the c3adc7756 build; the later commits change credential routing, caching and diagnostics, not the card or Settings layout) — Deployment left on Automatic; the card and Settings show the detected tenant, the source label web · NaN Builders, per-model resets, and no premium rows (the dashboard hides the same two tiers as "NOT IN YOUR PLAN"):

App refresh trace (system log at verbose level, cookie names only) — two user-initiated refreshes on the packaged app at head a3eac99fc: the first starts from an empty cache, imports from Chrome, and stores the cookie records only after the quota request succeeds; the second replays the records with the per-endpoint cookie lists and no browser read. Cookie names only, never values. The live NaN session has a single root-path, unexpired cookie and the server did not redirect or reject it, so the exclusion, redirect-refusal, and rejection-then-eviction branches cannot be forced against the real tenant; those are pinned by HelmcodeCachedSessionBoundaryTests and HelmcodeDeploymentDetectionTests with exact-line assertions on the same diagnostics (path-excluded cookie never reaches billing, expired cookie dropped, 302 surfaces as a rejected session with the redirect refused, rejected cached tenant evicted before the next candidate). This dev build is ad-hoc signed, so its cache lived in process memory rather than the Keychain; the code path is identical:

# refresh 1 (user-initiated, empty cache): miss -> Chrome import -> candidate (import) -> 3 requests -> stored after the quota 200
20:51:24 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:51:24 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:51:27 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:51:27 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:51:36 [com.steipete.codexbar:helmcode-cookie] Found NaN Builders dashboard cookies in Chrome Profile 1
20:51:36 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:51:36 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:51:37 [com.steipete.codexbar:helmcode-cookie] Found NaN Builders dashboard cookies in Chrome Profile 1
20:51:37 [com.steipete.codexbar:helmcode] helmcode: candidate NaN Builders (import)
20:51:37 [com.steipete.codexbar:helmcode] GET cloud-api.nan.builders/api/usage/quota cookies=[nan_session] excluded-expired=[] excluded-path=[]
20:51:37 [com.steipete.codexbar:helmcode] GET cloud-api.nan.builders/api/billing cookies=[nan_session] excluded-expired=[] excluded-path=[]
20:51:38 [com.steipete.codexbar:helmcode] GET cloud-api.nan.builders/api/billing/credits cookies=[nan_session] excluded-expired=[] excluded-path=[]
20:51:38 [com.steipete.codexbar:helmcode-usage] No prepaid balance for this tenant (credits endpoint unavailable).
20:51:38 [com.steipete.codexbar:cookie-cache] Cookie cache stored (provider=helmcode source=Chrome Profile 1)

# refresh 2 (user-initiated, later): cache hit -> candidate (cache) -> the same 3 requests from the saved records, no browser read
20:53:16 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:53:16 [com.steipete.codexbar:cookie-cache] Cookie cache hit (provider=helmcode)
20:53:16 [com.steipete.codexbar:cookie-cache] Cookie cache miss (provider=helmcode)
20:53:16 [com.steipete.codexbar:cookie-cache] Cookie cache hit (provider=helmcode)
20:53:16 [com.steipete.codexbar:cookie-cache] Cookie cache hit (provider=helmcode)
20:53:16 [com.steipete.codexbar:helmcode] helmcode: candidate NaN Builders (cache)
20:53:16 [com.steipete.codexbar:helmcode] GET cloud-api.nan.builders/api/usage/quota cookies=[nan_session] excluded-expired=[] excluded-path=[]
20:53:16 [com.steipete.codexbar:helmcode] GET cloud-api.nan.builders/api/billing cookies=[nan_session] excluded-expired=[] excluded-path=[]
20:53:17 [com.steipete.codexbar:helmcode] GET cloud-api.nan.builders/api/billing/credits cookies=[nan_session] excluded-expired=[] excluded-path=[]
20:53:17 [com.steipete.codexbar:helmcode-usage] No prepaid balance for this tenant (credits endpoint unavailable).

Provider eligibility

Per the "Hosted relay eligibility" bar in docs/provider.md and the criteria applied when declining AnyRouter (#2218): identifiable operator, clearly authorized upstream access, operating track record.

1. Identifiable legal operator and jurisdiction. Helmcode and NaN Builders are operated by Helmcode S.L. (NIF B44788511), Avenida Quinto Centenario 27, 38683 Santiago del Teide, Santa Cruz de Tenerife, Spain, under Spanish law. Sources: https://helmcode.com/terms (legal notice naming Helmcode S.L., NIF, and address) and https://nan.builders/terms ("NaN is operated by Helmcode S.L. (NIF B44788511)"), so the community tenant and the enterprise tenant are the same legal entity.

2. Clearly authorized upstream access. Helmcode serves open-weight models and publishes the licence for each one on https://helmcode.com/models: GLM-5.3 under Z.ai's licence ("the MIT text plus one clause, a Z.ai security review for any model-as-a-service business above $10bn of revenue"), DeepSeek V4 Flash (MIT), Qwen3.6 (Apache 2.0), Gemma4 (Gemma licence), plus embedding, rerank, and speech models. The page states models are "served only from the EU". No closed-model API resale is advertised and there is no key pooling: NaN's acceptable-use policy says "Do not share, resell or transfer your API key" (https://nan.builders/terms). The NaN Builders community tier and its published allowances: https://nan.builders/#membership. Helmcode publishes no statement about third-party clients consuming the dashboard endpoints, which is why the provider treats that contract as unversioned (see Risk containment).

3. Public operating track record. Public pricing and status pages (https://helmcode.com/pricing, https://status.helmcode.com), a public changelog with entries since April 2026 (https://helmcode.com/changelog, first entry 2026-04-22), and production customers named on the site (Ayuntamiento de Cartagena, FRS, Easygoband, among others).

Author disclosure. I am a paying NaN Builders subscriber and have no affiliation with Helmcode S.L. I will maintain this provider and respond to dashboard-contract drift.

Risk containment

The provider is default-off and deliberately narrow:

• Disabled by default (defaultEnabled: false), not widget-selectable; nothing runs unless the user enables it.
• Chrome-only cookie import, and only on an explicit user-initiated refresh in the app (never during CLI runs, background refreshes, or tests).
• The validated session is cached per tenant (providerVariant scope), so a NaN Builders session is never replayed to cloud-api.helmcode.com or vice versa; a rejected session evicts the cache and requires a fresh import.
• Manual mode and HELMCODE_COOKIE keep precedence and never read or write the cache; a pasted capture is sent only to the tenant detected from its host, never to both.
• Requests use an ephemeral, cookie-storage-disabled, redirect-guarded session; dashboard endpoints are hard-coded HTTPS per tenant.
• Quota parsing fails visibly (a drifted-fixture tripwire test guards it); billing and credits requests fail soft so a billing change cannot hide valid quota. The tenants share the quota API but differ in billing: the prepaid balance exists on Helmcode Cloud only, and premium rolling-window tiers are hidden unless the account's subscription is premium.
• No API key is ever requested; the provider only reads the dashboard the user is entitled to see.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99a71143a1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 5, 2026, 3:07 PM ET / 19:07 UTC.

ClawSweeper review

What this changes

Adds Helmcode Cloud and NaN Builders usage tracking through dashboard cookies, with deployment selection, cached sessions, quota displays, documentation, and tests.

Merge readiness

⛔ Blocked before merge - 6 items remain

This remains a useful, distinct provider addition. Earlier functional concerns are addressed and the new live evidence demonstrates meaningful progress, but the saved-cookie security boundary is not fully established by the inspectable proof.

Priority: P2
Reviewed head: a3eac99fc367afde6ea57c85e1cad2c6d492bee4
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful implementation and substantial real evidence, with no remaining discrete finding but an unresolved credential-boundary proof gate.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Authority-chain proof required: current-head CLI and app traces support real quota retrieval and saved-session reuse, and inspected screenshots support the UI. The supplied text assigns forbidden cookie scopes, redirect refusal, and rejected-cache eviction to transport-stub tests, which do not establish those production-client boundaries. The omitted body remainder remains unknown; inspect it before requesting additional evidence. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Authority-chain proof required: current-head CLI and app traces support real quota retrieval and saved-session reuse, and inspected screenshots support the UI. The supplied text assigns forbidden cookie scopes, redirect refusal, and rejected-cache eviction to transport-stub tests, which do not establish those production-client boundaries. The omitted body remainder remains unknown; inspect it before requesting additional evidence. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	10 items	Repository policy: Read the complete root policy; no nested AGENTS.md files or maintainer-notes directory were found. Applied Chrome-only import, provider isolation, concurrency, and test-safety guidance. No builds or tests were executed during this read-only review. Still necessary on current main: The fetched main tree contains no Helmcode or NaN Builders implementation or documentation matches. Its shared HTTP client also lacks this branch's optional refuse-all-redirects mode. No same-repository merged replacement is established by the supplied related context. Latest release boundary: The supplied latest release revision, v0.56.6, likewise contains no Helmcode or NaN Builders matches in source, documentation, or README.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar providers turn account usage responses into menu-bar and CLI summaries. This provider selects a dashboard deployment, obtains its session cookies, and converts quota and optional billing responses into usage windows.

flowchart TD
  A[Deployment and cookie settings] --> C[Select dashboard deployment]
  B[Chrome session or saved cookies] --> C
  C --> D[Filter cookies for each endpoint]
  D --> E[Dashboard requests with redirects refused]
  E --> F[Validate quota and update session cache]
  E --> G[Read optional billing]
  F --> H[Menu bar and CLI usage]
  G --> H

Loading

Decision needed

Question	Recommendation
Does the complete captured proof establish saved-session boundary enforcement through the production HTTP client?	Review the complete existing proof first: Inspect the omitted evidence and require only any still-unproven saved-cookie boundary scenarios before merge.

Why: Positive runtime evidence is inspectable, but negative cases are described as stub-tested and the remaining captured body could not be retrieved.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: current-head CLI and app traces support real quota retrieval and saved-session reuse, and inspected screenshots support the UI. The supplied text assigns forbidden cookie scopes, redirect refusal, and rejected-cache eviction to transport-stub tests, which do not establish those production-client boundaries. The omitted body remainder remains unknown; inspect it before requesting additional evidence. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - Saved browser credentials cross deployment and endpoint boundaries; inspectable negative-case evidence does not exercise the real HTTP client's redirect refusal or demonstrate rejected-cache eviction across a subsequent refresh.
• Resolve merge risk (P1) - The captured proof body omits 4,119 UTF-16 units, so its remaining evidence must be inspected before concluding that additional contributor work is necessary.
• Complete next step (P2) - Review the full captured proof and resolve any remaining saved-cookie boundary coverage before merge. Additional evidence may be redacted terminal output or logs; remove credentials, private endpoints, and other private details. Updating the PR body should trigger another review; otherwise ask a maintainer to comment @clawsweeper re-review.
• Resolve review confidence - ClawSweeper must reach high confidence before merge readiness is known.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +1,729/-3; tests and fixtures +2,042/-13	The growth implements a new two-deployment provider and its credential-boundary coverage.

Merge-risk options

Maintainer options:

1. Resolve the remaining credential-boundary evidence (recommended)
   Review the full existing transcript, then obtain real-client evidence for any uncovered forbidden-scope, redirect, and rejection-recovery cases.
2. Accept the documented coverage gap
   A maintainer may explicitly own the remaining uncertainty through a proof override.

Technical review

Best possible solution:

Retain the provider-owned implementation and scoped cookie records, with final-I/O evidence establishing cookie isolation, redirect refusal, and rejection recovery.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this adds a provider; supplied real runs demonstrate quota retrieval, and no concrete new functional failure was established.

Is this the best way to solve the issue?

Yes, the provider descriptor, existing cookie cache, and shared transport are appropriate integration points; the remaining concern is boundary evidence rather than a demonstrated need to redesign the patch.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3a676e143e23.

Labels

Label justifications:

• P2: This is a bounded provider addition with useful live evidence and no established urgent regression.
• merge-risk: 🚨 security-boundary: The branch persists and replays browser credentials, while production-client enforcement of the forbidden-scope and redirect cases remains unestablished by inspectable proof.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: current-head CLI and app traces support real quota retrieval and saved-session reuse, and inspected screenshots support the UI. The supplied text assigns forbidden cookie scopes, redirect refusal, and rejected-cache eviction to transport-stub tests, which do not establish those production-client boundaries. The omitted body remainder remains unknown; inspect it before requesting additional evidence. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Repository policy: Read the complete root policy; no nested AGENTS.md files or maintainer-notes directory were found. Applied Chrome-only import, provider isolation, concurrency, and test-safety guidance. No builds or tests were executed during this read-only review. (AGENTS.md:1, a3eac99fc367)
• Still necessary on current main: The fetched main tree contains no Helmcode or NaN Builders implementation or documentation matches. Its shared HTTP client also lacks this branch's optional refuse-all-redirects mode. No same-repository merged replacement is established by the supplied related context. (Sources/CodexBarCore/ProviderHTTPClient.swift:195, 3a676e143e23)
• Latest release boundary: The supplied latest release revision, v0.56.6, likewise contains no Helmcode or NaN Builders matches in source, documentation, or README. (1696c7a71c94)
• Credential lifecycle and previous repairs: The strategy selects one credential, restricts cached candidates to the pinned deployment, reconstructs cookie records, evicts rejected entries, and gates browser import on user-initiated app interaction. Current tests include the previously missing transport override, serialized dashboard checks, and registered legacy-cache test. (Sources/CodexBarCore/Providers/Helmcode/HelmcodeProviderDescriptor.swift:108, a3eac99fc367)
• Scoped requests and optional failures: The fetcher builds cookie headers per endpoint, uses an ephemeral session without automatic cookie storage, refuses redirects, and preserves required quota when optional billing or credits fail. This addresses the earlier inline review about optional authentication failures. (Sources/CodexBarCore/Providers/Helmcode/HelmcodeUsageFetcher.swift:243, a3eac99fc367)
• Positive real behavior evidence: The captured PR body reports current-head CLI quota retrieval, explicit-header rejection on both deployments, and app import followed by saved-record reuse. Both prepared screenshots were inspected and visibly show the usage card and Automatic deployment settings. Screenshots are attributed to c3adc77; current-head runtime claims are attributed to a3eac99. The contributor's earlier authenticated-run report is at Add Helmcode usage provider #3422 (comment). (a3eac99fc367)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Hinotobi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Review the complete existing proof; for any remaining gaps, provide real-client traces showing wrong-deployment and expired cookies excluded, path-restricted cookies withheld from billing and redirects, and rejected cached sessions absent on the next refresh.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-09-04T18:39:48.279Z sha 422eea3 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T22:00:04.891Z sha 40e17c9 :: blocked before merge. :: none
• reviewed 2026-09-05T10:23:07.556Z sha 4509073 :: needs real behavior proof before merge. :: [P1] Resolve the raw capture from the selected credential source | [P1] Guard all macOS-only importer references | [P2] Update the Linux fixtures to use available initializers | [P2] Validate imported sessions before selecting an automatic deployment | [P2] Use manual capture detection for dashboard links
• reviewed 2026-09-05T10:43:13.055Z sha c3adc77 :: needs real behavior proof before merge. :: [P1] [P1] Resolve the raw capture from the selected credential source | [P1] [P1] Guard all macOS-only importer references | [P2] [P2] Update the Linux fixtures to use available initializers | [P2] [P2] Validate sessions before selecting an automatic deployment | [P2] [P2] Use manual capture detection for dashboard links | [P2] [P2] Preserve cookie path and expiry restrictions in cached sessions
• reviewed 2026-09-05T11:15:06.724Z sha 3673070 :: needs real behavior proof before merge. :: [P1] [P1] Resolve the raw capture from the selected credential source | [P2] [P2] Preserve cookie path and expiry restrictions in cached sessions | [P2] [P2] Validate sessions before selecting an automatic deployment | [P2] [P2] Use manual capture detection for dashboard links
• reviewed 2026-09-05T17:12:22.000Z sha cc4685c :: needs real behavior proof before merge. :: [P2] Preserve cookie path restrictions across redirects | [P2] Resolve the Settings dashboard link from the selected credential | [P2] Honor the bare-credential fallback in dashboard resolution | [P2] Install the rejection test’s HTTP transport stub
• reviewed 2026-09-05T18:02:14.856Z sha 632238f :: needs real behavior proof before merge. :: [P2] Install the rejection test’s HTTP transport stub | [P2] Serialize the dashboard tests with the other cache-mutating tests | [P3] Register the legacy-cache check as a test
• reviewed 2026-09-05T18:37:59.585Z sha a3eac99 :: needs real behavior proof before merge. :: none

[luisgonzaleznf]

Live authenticated proof added — an accepted real dashboard session now refreshes quota end-to-end. Summary of the validation run against the community tenant (cloud.nan.builders, NaN Builders — Helmcode's community brand; identical cloud-api.* contract to cloud.helmcode.com):

Production importer + fetcher, real session

• Chrome Profile 1 session imported by HelmcodeCookieImporter (deployment nanBuilders); 615-char Cookie header captured to a 0600 temp file and never printed or logged.
• GET https://cloud-api.nan.builders/api/usage/quota → HTTP 200 with that session: periodStart 2026-09-01, reset 2026-10-01T00:00:00Z.
• Parsed snapshot (redacted, no cookie/identity values):
  • glm5.3-flash: 22,263,058 / 2,000,000,000 tokens (1.1%) — primary window
  • glm5.2 / glm5.3 / deepseek-v4-flash: 0 / 3,000,000,000 each
  • mimo-v2.5: 0 / 1,000,000,000 · qwen3.8-flash: 0 / 500,000,000
  • caps match the published NaN plan allowances; credits endpoint returned no usable body → balance absent, quota stays valid (documented fail-soft path).

Full CLI pipeline (dataConfidence: exact)

$ HELMCODE_DEPLOYMENT=nanbuilders codexbar usage --provider helmcode --source web --format json
[{"provider":"helmcode","source":"web","usage":{"dataConfidence":"exact",
  "identity":{"providerID":"helmcode","loginMethod":"Dashboard session"},
  "primary":{"usedPercent":1.13208335,"resetDescription":"glm5.3-flash · 22,641,667 / 2,000,000,000 tokens","resetsAt":"2026-10-01T00:00:00Z"},
  "extraRateWindows":[…5 windows, all reset 2026-10-01T00:00:00Z…]}}]

The live run also caught a real bug now fixed in 40e17c932: SweetCookieKit normalizes cookie domains without the leading dot, so domain-scoped sessions (.helmcode.com / .nan.builders) were silently dropped by the subdomain header match — HelmcodeCookieImporter now rebuilds HTTPCookies preserving the browser's domain scope (unit-tested). Same commit adds first-class NaN Builders deployment support (Settings picker + HELMCODE_DEPLOYMENT), deployment-scoped cookie import, and 8 new tests (15 focused tests green, make check clean).

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33924048402
• Updated: 2026-09-04T22:06:20.523Z