fix(alibaba): support Personal token plan quota fetches - #2515
fix(alibaba): support Personal token plan quota fetches#2515wdmitchelluk wants to merge 4 commits into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 261ebc4b2b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
wdmitchelluk
changed the title
clawsweeper
Bot
added
rating: 🦪 silver shellfish
|
Codex review: needs maintainer review before merge. Reviewed July 30, 2026, 5:14 PM ET / 21:14 UTC. ClawSweeper reviewWhat this changesThe PR changes Alibaba Token Plan Personal and Team quota fetches to use session-derived Merge readinessThis PR remains necessary: it targets active Alibaba Token Plan Personal quota failures and supplies redacted authenticated proof for the International Personal path plus focused regression coverage. The patch has no confirmed correctness defect, but its token-refresh changes are compatibility-sensitive for existing cookie and session flows, so it should receive normal human maintainer review rather than automated closure or repair. Priority: P2 Review scores
Verification
How this fits togetherCodexBar’s Alibaba Token Plan provider reads browser or manually supplied session cookies, sends regional quota requests to Alibaba, and converts responses into usage windows for the menu bar and CLI. This PR changes the token-selection and retry stage between cookie ingestion and Personal or Team quota requests. flowchart LR
A[Browser or manual cookies] --> B[Alibaba Token Plan provider]
B --> C[Resolve session token]
C --> D[Personal or Team quota request]
D --> E[Parse usage and API errors]
E --> F[Usage snapshot]
F --> G[Menu bar and CLI output]
Before merge
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Preserve the existing first-request cookie behavior, retain the one-shot recovery only for clearly authentication-related failures, and land the focused test-backed fix after a maintainer confirms the Personal and Team compatibility contract. Do we have a high-confidence way to reproduce the issue? No high-confidence independent current-main reproduction was established in this read-only review. The failure mechanism is source-reproducible from the described hardcoded workspace and nested-response paths, and the contributor supplies redacted authenticated after-fix evidence for International Personal. Is this the best way to solve the issue? Yes, provisionally: removing the stale Personal workspace override, preserving Personal/Team separation, surfacing nested API errors, and retrying only authentication-token failures is a focused solution within the existing provider boundary. Maintainer review should confirm the retry classification remains compatible with current cookie-session behavior. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 8ef86077e70a. LabelsLabel justifications:
EvidenceWhat I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (6 earlier review cycles)
|
Use the active Alibaba session instead of a hardcoded workspace, prefer an existing SEC token without preflight delay, and keep Personal failures from falling through to Team quota data.
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 81fd03439c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Retry Personal and Team quota requests once with a freshly resolved token when a cookie-backed token is rejected, without delaying the initial request or repeating the rejected token.
|
@codex review |
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
Codex review is not enabled for this repo. Please contact the admins of this repo to enable Codex. |
clawsweeper
Bot
added
rating: 🦐 gold shrimp
|
@clawsweeper re-review |
clawsweeper
Bot
added
proof: sufficient
clawsweeper
Bot
added
rating: 🐚 platinum hermit
1 participant
Summary
sec_tokenwith International and China Mainland Personal token-plan requestssec_tokenimmediately, avoiding dashboard and user-info preflight delays; if it is rejected, resolve a different token and retry onceRoot cause
Every Personal request included a hardcoded Alibaba workspace switch. With the reporter's International Personal account, Alibaba returned HTTP 200 with a nested
BailianGateway.Workspace.NotAuthorisedfailure for that workspace, so CodexBar did not receive usable Personal usage data.The fix removes that stale workspace override and uses the active authenticated session. It does not fall back to Team data when a Personal request fails.
Redacted authenticated proof
Verified against commit
43f77a92c1ef2ff9d066b16a1f35da59bae10ea0using the reporter's existing CodexBar/Brave International Personal session. Cookies, tokens, account identifiers, request identifiers, hosts, endpoints, and local paths are omitted.The authenticated command was run twice against the exact final source and succeeded both times. Before the fix, the same session received HTTP 200 with nested
BailianGateway.Workspace.NotAuthorised.Verification
sec_token81fd0343)make test: 758 selections in 64 groups; 64 first-pass successes, 0 failures, 0 retries, 0 timeoutsmake check: SwiftFormat, SwiftLint, localization, documentation, package, signing, and CI policy checks pass with 0 formatting or lint violationsAuthenticated live coverage is available for International Personal only because the available session is an International Personal account. Team and China Mainland behavior is covered by deterministic request/response regression tests; this PR does not claim those variants were live-tested with unavailable account credentials.
Refs #2349 and #2500.