fix: reject unrepresentable numeric usage safely

[steipete]

Usage parsers could admit an unrepresentable rounded integer because Double(Int.max) rounds upward. Replace the trapping conversions in MiMo, Pi/OMP, OpenCodex, and Bedrock with failable conversion after each source's existing rounding step. Oversized finite subprocess timeouts now saturate safely.

Preserve valid neighboring fields, MiMo/OpenCodex exact integer payloads, Pi/Bedrock nearest rounding, and MiMo/OpenCodex truncation. OpenCodex's established negative-fraction fallback remains zero. Version the OpenCodex parse cursor so values clamped by an older parser are reparsed once from unchanged logs; subsequent reads reuse the corrected cache. The generation lives in the cursor transaction so an older writer cannot leave a misleading current-generation marker behind.

The refactor removes 16 production lines. Includes boundary, valid-field, rounding, and legacy-cache regressions, plus changelog and parsing documentation.

Validation: the added negative-fraction regression failed before correction, and the legacy-cache regression failed for both absent and old generations before invalidation was added. The repaired focused suites passed. Full make test passed all 1,035 selections across 87 groups on the first pass, with no retries or timeouts. make check passed. After integrating latest main, 145 tests in 9 affected suites passed; the numeric production code was unchanged. Independent P0–P2 review passed on the final integration. All checks passed for commit 9264b28: https://github.com/steipete/CodexBar/actions/runs/34197381254.

This patch fixes numeric conversion and reuse of older parsed rows. The separate, pre-existing unchecked additions in OpenCodex report aggregation are addressed separately in #3501; this PR does not claim comprehensive aggregate-overflow protection.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 8, 2026, 3:08 AM ET / 07:08 UTC.

ClawSweeper review

What this changes

The PR safely converts numeric usage counts and large subprocess timeouts, refreshes older OpenCodex caches, and adds regression coverage and documentation.

Merge readiness

✅ Ready for maintainer review

Keep open as a useful, review-ready fix: current main still contains the unsafe conversions, and the previous merge-conflict blocker is resolved. No introduced blocking defect was found.

Priority: P2
Reviewed head: 9264b28cd9ec2f1cdff10a5888f9197467c3e9d6

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with meaningful regression coverage and no blocking correctness or security findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The OWNER-authored PR is exempt from contributor runtime proof, and no authority boundary changes. Supplied focused validation covers numeric parsing, subprocess completion with large timeouts, and legacy-cache correction.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The OWNER-authored PR is exempt from contributor runtime proof, and no authority boundary changes. Supplied focused validation covers numeric parsing, subprocess completion with large timeouts, and legacy-cache correction.
Evidence reviewed	8 items	Repository policy and review scope: Read the complete root AGENTS.md. It is the only AGENTS.md in the checkout; no maintainer-notes directory exists. Applied the focused-test, provider-isolation, and small-change guidance. No builds, tests, provider probes, or repository edits were performed. Introduced numeric changes remain necessary: Read the complete introduced diff and surrounding conversion paths. Main still uses trapping integer conversions at floating-point boundaries. The patch preserves source-specific rounding and exact MiMo/OpenCodex integer payloads while rejecting unrepresentable results. Cache upgrade compatibility: Missing or older cursor versions force a full reparse. Fresh cursors record the new version, and rows plus cursor remain in the existing transaction. The added regression seeds legacy SQLite rows with absent and old versions, verifies corrected neighboring fields and exact Int.max preservation, then checks that the next unchanged read parses zero bytes.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar reads local usage logs and provider responses to display usage and spending. These changes validate numeric inputs before reporting or caching them, and safely convert timeouts used by subprocesses.

flowchart TD
  A[Local usage logs] --> C[Checked numeric conversion]
  B[Provider metric responses] --> C
  C --> D[Usage and spending reports]
  A --> E[OpenCodex cache version check]
  E -->|Older parser| C
  E -->|Current parser| D
  F[Subprocess timeout] --> G[Safe timer duration]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production −16 lines; tests +157 lines	The repair reduces production code while adding boundary, rounding, timeout, and cache-upgrade coverage.

Technical review

Best possible solution:

Retain the focused checked conversions and transactional cache invalidation, with aggregate-overflow hardening handled separately.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: main admits the upward-rounded Double(Int.max) boundary before trapping conversion, and the added fixtures exercise that boundary. No runtime reproduction was performed during this review.

Is this the best way to solve the issue?

Yes. Failable conversion after the existing rounding step is a narrow repair, and cursor versioning prevents older cached results from bypassing it.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against c3f3ea1faf70.

Labels

Label justifications:

• P2: This is a bounded reliability repair for malformed or extreme numeric inputs, without evidence of a widespread urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from contributor runtime proof, and no authority boundary changes. Supplied focused validation covers numeric parsing, subprocess completion with large timeouts, and legacy-cache correction.

Evidence

What I checked:

• Repository policy and review scope: Read the complete root AGENTS.md. It is the only AGENTS.md in the checkout; no maintainer-notes directory exists. Applied the focused-test, provider-isolation, and small-change guidance. No builds, tests, provider probes, or repository edits were performed. (AGENTS.md:1, 9264b28cd9ec)
• Introduced numeric changes remain necessary: Read the complete introduced diff and surrounding conversion paths. Main still uses trapping integer conversions at floating-point boundaries. The patch preserves source-specific rounding and exact MiMo/OpenCodex integer payloads while rejecting unrepresentable results. (Sources/CodexBarCore/Vendored/OpenCodexUsage/OpenCodexUsageParser.swift:341, 9264b28cd9ec)
• Cache upgrade compatibility: Missing or older cursor versions force a full reparse. Fresh cursors record the new version, and rows plus cursor remain in the existing transaction. The added regression seeds legacy SQLite rows with absent and old versions, verifies corrected neighboring fields and exact Int.max preservation, then checks that the next unchanged read parses zero bytes. (Tests/CodexBarTests/OpenCodexUsageStoreIncrementalTests.swift:14, 9264b28cd9ec)
• Previous conflict blocker resolved: The test-merge commit records the pinned main parent followed by the exact reviewed head. Its resulting tree has no differences from the checkout. This supersedes the previous review's conflict concern. (3298a8c682d7)
• Reported validation and review continuity: The captured PR body reports failing-before/passing-after negative-fraction and legacy-cache regressions, make check success, and all 1,035 full-suite selections passing. After main integration, it reports 145 tests across nine affected suites passing. These reports address the previous validation request; final-head CI remains routine validation. Tests were not independently rerun in this read-only review. (9264b28cd9ec)
• Merged related work is distinct: fix: share CLI login lifecycle and honor cancellation #3484 merged the CLI login lifecycle work, but main's separate SubprocessRunner timeout conversion remains unsafe. It does not supersede the numeric parser and cache repairs here. The supplied Windsurf issue is unrelated to the actual cross-repository timeline reference. (Sources/CodexBarCore/Host/Process/SubprocessRunner.swift:75, c3f3ea1faf70)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Olddonkey: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Yuxin Qiao: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-09-08T01:08:06.553Z sha 4dc4193 :: needs maintainer review before merge. :: none
• reviewed 2026-09-08T01:21:21.440Z sha 3c902f5 :: needs maintainer review before merge. :: none
• reviewed 2026-09-08T01:31:10.307Z sha be1cd62 :: blocked before merge. :: none
• reviewed 2026-09-08T01:39:03.582Z sha be1cd62 :: blocked before merge. :: none
• reviewed 2026-09-08T06:47:44.532Z sha be1cd62 :: blocked before merge. :: none

[steipete]

Checking the landing path for this completed fix. The PR still targets the old CLI-login branch even though #3484 is on main. I am retargeting it to main, preserving the numeric changes and their validation, then checking the synchronized candidate before landing.