chore: land triage train 2026-09-21 (#3806 #3807 #3816 #3818 #3814 #3817 #3812 #3811 #3815 #3813) - #3823
Merged
Conversation
Adopt the five scoped menu/settings surfaces from #3695. Keep staged updates on their existing install route and omit the sidebar badge. Consolidate About's Updates section, remove the unused email formatter, and simplify provider version matching without changing its output. Co-authored-by: Alec Gutman, Chip <44984861+Chipagosfinest@users.noreply.github.com> (cherry picked from commit ecd7410)
) (cherry picked from commit 9463471)
…3816) Replace rejected CodexBar cache items only when fresh data is available, and retain bounded repair state through delete/add failures and duplicate-item updates. Keep inconclusive no-UI delete failures retryable. Enforce stored Claude prompt policy at the external security reader boundary. Document ACL replacement and signing identity limits without claiming the recurring prompt report is reproduced. Refs #3249 Refs #3798 (cherry picked from commit a1dab45)
Infer owned component baselines without recounting copied token snapshots, including advancing snapshots and inherited-only suffixes. Preserve child model context, independent counters, and cumulative replay deduplication. Reparse older native caches through parser revision 4 without rebuilding compatible history stores. Refs #3524. (cherry picked from commit 67960cc)
Distinguish inaccessible discovered Chrome localStorage from missing sessions and token rejection while preserving usable profiles and token/org priority. Document app and CLI manual authentication with exact token/header steps. Remove an unused importer wrapper and consolidate duplicate parsing so production code remains smaller. Cover storage permissions, ignored hidden files, session precedence, and CLI guidance with synthetic regression tests. Refs #3660, #3781. (cherry picked from commit 3e045d7)
Filter shared model rankings by provider and label omitted history as partial. Keep day-scoped models out of full-window rankings, preserving unknown totals. Reuse checked aggregation without changing missing-cost or overflow behavior. Fixes #3714 Closes #3747 Co-authored-by: Alec Gutman <44984861+Chipagosfinest@users.noreply.github.com> (cherry picked from commit a67c1e6)
Bound the ambient refresh wait without cancelling the provider request, and refresh the adapter independently when a stalled predecessor delays that read. Keep credential transactions serialized through the current adapter list. Adopts #3750 with a bounded join instead of a task group that still waits for its suspended child. Refs #3736. Co-authored-by: keepitmello <keepitmello@users.noreply.github.com> (cherry picked from commit b73c145)
Name the disabled Keychain setting without changing credential precedence or prompt policy. Keep active subscription identity and an unavailable-quota note when subs_usage is omitted or null, while rejecting malformed payloads. Share snapshot fields and remove redundant credential checks. Adopts #3772. Verified with synthetic credentials and both plugin engines. Co-authored-by: oldcai <hi@oldcai.com> (cherry picked from commit 4d8a9ab)
Route USD conversion through the existing pivot and remove one-use cache and rate wrappers. Preserve public initialization, normalized currency codes, cached-rate precedence, and locking. Use in-memory defaults for offline fallback and cache coverage. Follow-up cleanup for the converter reviewed in #3624, whose TRY support is already on main. No currency behavior changes are intended. Co-authored-by: aguvener <90110302+aguvener@users.noreply.github.com> (cherry picked from commit f8052f9)
(cherry picked from commit 6c23684)
Keep key-bound user and team usage, private-network origins, budget labels, and identity-only snapshots. Delete the Swift fetch and parse twin. Record NeuralWatt’s remaining typed transport retry and cancellation blocker without changing its native implementation. (cherry picked from commit 3a4e27a)
(cherry picked from commit 636d026)
Read tenant dashboards through a bundled TypeScript plugin, confine manual cookies to the selected tenant, and require explicit premium billing before showing rolling tiers. Preserve per-model resets and Cloud-only prepaid balances. Co-authored-by: luisgonzaleznf <luis@getduckbill.com> (cherry picked from commit dc72e99)
(cherry picked from commit b1c8a16)
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P2
|
Codex review: needs maintainer review before merge. Reviewed September 21, 2026, 6:17 AM ET / 10:17 UTC (Revision 3). ClawSweeper reviewWhat this changesCombines provider and credential repairs, corrected forked-session accounting, Helmcode support, plugin conversions, menu improvements, shared-statistics fixes, and preservation of eligible widget measurements after failed refreshes. Merge readiness✅ Ready for maintainer review Keep open: this owner-sponsored integration contains useful work absent from current main. No blocking introduced defect was established in the reviewed paths; repository policy also excludes automatic closure. Priority: P2 Review scores
Verification
How this fits togetherCodexBar collects provider quotas and local usage history, associates measurements with accounts, and presents them in menus, shared cards, and widgets. This integration changes collection, credential handling, accounting, and presentation across those layers. flowchart LR
A[Provider settings and credentials] --> B[Credential and cookie checks]
B --> C[Provider requests]
D[Local session histories] --> E[Usage accounting]
C --> F[Account scoped measurements]
E --> F
F --> G[Menus and shared cards]
F --> H[Widget snapshots]
Before mergeNone. Agent review detailsSecurityNone. Review metrics
Technical reviewBest possible solution: Retain the integrated fixes with existing account and credential boundaries, bounded cache reparsing, and the documented limits on unresolved reporter scenarios. Do we have a high-confidence way to reproduce the issue? Yes, for the bounded repairs: unchanged-fingerprint expired credentials and inherited fork counters have concrete source triggers and regression fixtures. No live reproduction was performed, and the broader linked reports remain only partially addressed. Is this the best way to solve the issue? Yes: the adopted scope reuses existing plugin, credential, and snapshot owners, removes native fetch duplicates, and preserves upgrade behavior through focused compatibility tests. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against d8d0f3394989. LabelsLabel justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
History |
(cherry picked from commit 64803db)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integrates eleven reviewed triage lanes in one branch so the saturated macOS runner queue validates the combined result and CHANGELOG entries do not repeatedly conflict across separate squash merges. Nineteen substantive commits are cherry-picked in the requested order with original authors, bodies, contributor trailers, and
-xprovenance; each subject carries its lane PR number. Two changelog-only relocation commits are folded into the conflict resolutions.Lanes and verdicts
Integration resolutions
Preserved main and lane changelog bullets verbatim in their intended top Unreleased sections, including thanks. Kept both Claude credential-documentation changes, combined exact architecture anchors with Helmcode's provider references, and recounted the conversion matrix while retaining the NeuralWatt blocker.
docs/ui.mdmerged with all main and lane bullets intact. All three regeneration scripts produced no tracked changes. The widgets fold-in retains both sides' catalog entries and corrects ten exact refresh line anchors without weakening gatekeeper rules.Existing lane UI proof
These captures were inspected and published by the lane owners; they document the adopted lane changes, not a new live-app run of the train.
Verification
swift build --jobs 4: passed (117.24 seconds).make check: passed; zero SwiftLint violations across 2,532 files after the widgets fold-in.Scripts/test-plugin-engines.sh, with four jobs and explicit serial execution.ProviderArchitectureGatekeeperTests|WidgetEmptyProjectionTests|UsageStoreWidgetSnapshot|CodexBarWidgetProviderTests; independent blocker review returned no findings.make testwith Keychain access suppressed: all 119 groups passed on the first attempt (1,304 selected test selections), zero failures/retries/timeouts; 1,217.1 seconds total.git diff --check: passed. No live-account probes.Combined focused test command
Closes #3806, Closes #3807, Closes #3816, Closes #3818, Closes #3814, Closes #3817, Closes #3812, Closes #3811, Closes #3815, Closes #3813, Closes #3819.