feat(providers): add Qwen Cloud individual token-plan provider - #2361
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 99a25394e8
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| return cookies.contains { cookie in | ||
| guard Self.recognizedSessionCookies.contains(cookie.name) else { return false } | ||
| let domain = cookie.domain.lowercased().trimmingCharacters(in: CharacterSet(charactersIn: ".")) | ||
| return domain.hasSuffix("qwencloud.com") |
There was a problem hiding this comment.
With automatic import, this returns true for any recognized cookie on qwencloud.com; because the recognized set includes non-auth cookies like intl_locale (and account-id cookies without a ticket), a browser profile that merely visited Qwen Cloud can be selected before a later profile that is actually logged in. The fetch then sends only those cookies, gets loginRequired, clears/reimports the same profile, and the provider never reaches the valid session. Require an actual auth ticket/session cookie before returning true.
Useful? React with 👍 / 👎.
| if let scheme = URL(string: raw)?.scheme { | ||
| return scheme.lowercased() == "https" ? raw : nil | ||
| } | ||
| return raw |
There was a problem hiding this comment.
When QWEN_CLOUD_HOST is configured as a bare host (for example qwen-cloud.test, the form accepted by QWEN_CLOUD_QUOTA_URL and the Alibaba token-plan host override), this returns the bare string. dashboardURL and defaultQuotaURL then build qwen-cloud.test/... URLs with no scheme/host, so endpoint-override tests or local proxies fail before making a request; normalize bare hosts to HTTPS before returning.
Useful? React with 👍 / 👎.
…alize bare host overrides Review follow-ups for steipete#2361: - Cookie import now treats only login_aliyunid_ticket / qwen_sso_ticket as proof of an authenticated session. Locale prefs, account-id markers, and CSRF cookies scoped to qwencloud.com no longer select browser profiles that merely visited the site, which previously caused ticketless requests, loginRequired responses, and re-import loops. - QWEN_CLOUD_HOST now accepts bare hosts (e.g. qwen-cloud.test or qwen-cloud.test:8443) and normalizes them to HTTPS via the shared endpoint-override validator, matching the Alibaba token-plan host override, so dashboard/quota URLs and the Origin header stay valid. - Adds regression tests for both paths and documents the bare-host form.
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
Codex review: needs real behavior proof before merge. Reviewed July 28, 2026, 10:56 AM ET / 14:56 UTC. ClawSweeper reviewWhat this changesThis PR adds Qwen Cloud Token Plan usage tracking to CodexBar’s menu bar, CLI, widget, settings, and documentation, while extracting shared Aliyun OneConsole authentication and parsing helpers used by Qwen and Alibaba providers. Merge readiness⛔ Blocked until stronger real behavior proof is added - 5 items remain Keep this PR open for maintainer review. The prior SEC-token transport-failure finding appears addressed at the current head, and the branch contains focused regression coverage, but this is still a large new provider plus shared authentication refactor without final-head real-account proof after the later redirect, importer, and token-error changes. Priority: P2 Review scores
Verification
How this fits togetherCodexBar obtains provider usage from authenticated browser/manual credentials, converts provider responses into common usage windows, then exposes those windows through the menu bar, CLI, widget, and settings UI. This PR adds Qwen Cloud to that pipeline and moves common Aliyun OneConsole cookie, redirect, SEC-token, and JSON logic into shared provider infrastructure. flowchart LR
A[Browser or manual Qwen cookie] --> B[Qwen session import]
B --> C[SEC token resolution]
C --> D[Qwen Token Plan APIs]
D --> E[Usage window parser]
E --> F[Provider registry]
F --> G[Menu bar CLI widget settings]
H[Alibaba providers] --> I[Shared OneConsole helpers]
I --> C
Decision needed
Why: The implementation adds new provider and credential configuration surface while also widening shared code used by Alibaba providers; technical review cannot determine whether that support commitment fits the maintainers’ product scope. Before merge
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: If maintainers want Qwen Cloud as a supported core provider, retain the provider-specific boundaries and land it only after a redacted current-head authenticated CLI or packaged-app receipt confirms successful 5-hour and weekly window parsing without exposing cookies, account identity, request IDs, IP addresses, or private endpoints. Do we have a high-confidence way to reproduce the issue? Not applicable: this PR introduces an optional provider rather than fixing an established broken behavior. The supplied current-head test evidence is source-level validation, while real authenticated Qwen behavior is only evidenced at an earlier July 22, 2026 head. Is this the best way to solve the issue? Unclear: the provider follows CodexBar’s existing descriptor, settings, CLI, widget, and provider-documentation patterns, but the broad shared OneConsole refactor and the product decision to support Qwen Cloud require maintainer confirmation before this is the best long-term path. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 02b4ba278c81. LabelsLabel justifications:
EvidenceWhat I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (3 earlier review cycles)
|
Add a fully-wired "Qwen Cloud" provider that tracks the individual token plan subscription on https://home.qwencloud.com/billing/subscription/token-plan-individual (the plan that grants hosted Claude access), alongside all existing settings. Qwen Cloud shares the Aliyun one-console auth + BssOpenAPI gateway used by the Alibaba token plan, so it reuses that parser/cookie plumbing: - New provider `.qwencloud` (CLI name `qwen-cloud`, aliases qwencloud/qwen/ qwen-token-plan) with descriptor, web fetch strategy, monochrome icon, and a curated confetti palette. - QwenCloudUsageFetcher posts form-encoded GetSubscriptionSummary (BssOpenAPI-V3, productCode sfm_tokenplansolo_public_intl) after resolving sec_token from the dashboard HTML, the sec_token cookie, or /tool/user/info.json. - URL-scoped cookie headers for qwencloud.com plus a browser cookie importer over the qwencloud/alibabacloud/aliyun passport domains. - Settings UI (cookie source picker + manual Cookie header + "Open Token Plan" link), CLI (`codexbar usage --provider qwen-cloud`), diagnostics, widget, and docs (docs/qwen-cloud.md, README, providers.md, configuration.md). - Generalized AlibabaCodingPlanCookieImporter.importSession to accept a provider-specific domain list + session validator so Qwen Cloud can reuse it; the existing Alibaba behavior is unchanged (delegates with its own defaults). - Extended the Alibaba token-plan parser to read nested EquityList quota fields (CycleTotalValue/CycleSurplusValue/EndTime) without changing existing results. Tests: parser/snapshot/cookie-header/stub-fetch/import-validation suites plus an opt-in live smoke test (disabled by default; gated on QWEN_CLOUD_LIVE_TEST=1 and QWEN_CLOUD_COOKIE) so CI never touches the network or Keychain.
…alize bare host overrides Review follow-ups for steipete#2361: - Cookie import now treats only login_aliyunid_ticket / qwen_sso_ticket as proof of an authenticated session. Locale prefs, account-id markers, and CSRF cookies scoped to qwencloud.com no longer select browser profiles that merely visited the site, which previously caused ticketless requests, loginRequired responses, and re-import loops. - QWEN_CLOUD_HOST now accepts bare hosts (e.g. qwen-cloud.test or qwen-cloud.test:8443) and normalizes them to HTTPS via the shared endpoint-override validator, matching the Alibaba token-plan host override, so dashboard/quota URLs and the Origin header stay valid. - Adds regression tests for both paths and documents the bare-host form.
…ption response
Captures a real-world subscription-summary response from
home.qwencloud.com for an authenticated account with no active
individual token-plan subscription (TotalCount=0, zeroed quota fields).
The API returns HTTP 200 with Success=true rather than an error, so the
parser must not report a false subscription or synthesize a 100% bar.
Documents the actual contract encountered in production so future
parser changes can be checked against it. Verified end-to-end:
$ codexbar usage --provider qwen-cloud --source web --log-level verbose
-> Cookie cache hit
-> dashboard HTML 200 (18 kB)
-> /tool/user/info.json 200 (sec_token resolved)
-> GetSubscriptionSummary 200 (451 B, TotalCount=0)
Parser yields an empty primary window (no false quota) and an identity
loginMethod of "TOKEN PLAN", matching the user-visible label.
Complements the existing TotalCount=1 / TotalValue>0 fixtures.
a266bc3 to
d6a1184
Compare
Redacted verbose log (codexbar usage --provider qwen-cloud --source web --log-level verbose)Redacted raw subscription-summary response{"requestId":"<REDACTED>","code":"200","message":null,"action":null,"apiName":null,"data":{"RequestId":"<REDACTED>","Message":"Successful!","Data":{"Uid":<REDACTED>,"TotalSurplusValue":"0","TotalCount":0,"TotalValue":"0","ProductCode":"sfm_tokenplansolo_public_intl"},"Code":"Success","Success":true},"httpStatusCode":"200","accessDeniedDetail":null,"extendedCode":null,"successResponse":true}``` |
|
@codex review Updated head |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9085e05f21
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| .chromeBeta, | ||
| .brave, | ||
| .edge, | ||
| .arc, | ||
| .firefox, | ||
| .safari, |
There was a problem hiding this comment.
In Auto mode this default import order probes Chrome Beta/Brave/Edge/Arc/Firefox/Safari as soon as Chrome lacks a usable Qwen cookie, which can trigger extra browser/Keychain prompts for a new provider. The repo guidance says cookie imports should default Chrome-only when possible; please keep Qwen to Chrome by default and make broader browser lists opt-in.
AGENTS.md reference: AGENTS.md:L48-L48
Useful? React with 👍 / 👎.
| guard let fallbackSession = try AlibabaChromiumCookieFallbackImporter.importSession( | ||
| browser: browser, | ||
| domains: self.cookieDomains, | ||
| domains: domains, | ||
| logger: logger) |
There was a problem hiding this comment.
When the generic importer falls back to the locked Chromium DB path, this call still uses AlibabaChromiumCookieFallbackImporter.importSession, whose own private session check requires both login_aliyunid_ticket and an Aliyun account cookie before it returns. For Qwen SSO profiles that only have qwen_sso_ticket (accepted by QwenCloudCookieImport.authTicketCookies), the fallback returns nil before the provider-specific predicate below can accept it, so Auto import fails even though a valid Qwen session is present; pass the provider auth predicate into the fallback importer or return candidate cookies for the outer check.
Useful? React with 👍 / 👎.
| supportsTokenCost: false, | ||
| noDataMessage: { "Qwen Cloud cost summary is not supported." }), | ||
| fetchPlan: ProviderFetchPlan( | ||
| sourceModes: [.auto, .web], |
There was a problem hiding this comment.
With this provider registered as web-only here, the CLI's non-macOS preflight treats auto/web as requiring browser support and returns the unsupported-web response before QwenCloudWebFetchStrategy.isAvailable can use QWEN_CLOUD_COOKIE or a manual cookie. That makes codexbar usage qwen-cloud unusable on Linux/CI even when the user supplies the cookie that the fetcher explicitly supports; add a sourceModeRequiresWebSupport exception like the other manual-cookie providers.
Useful? React with 👍 / 👎.
|
Fixed the Qwen Cloud DataV2 runtime failure at head 008dc97. Root cause: the request sent cornerstoneParam.consoleSite=MODELSTUDIO_ALBABACLOUD, while Qwen Cloud's current public dashboard client requires QWENCLOUD. The gateway still returned HTTP 200 with a DataV2 envelope, but without the token-plan usage fields, which produced the reported “Missing token plan data” error. Added a request-contract regression at the public fetchUsage seam and changed the production context to QWENCLOUD. Verification:
No live provider probe, browser-cookie import, or Keychain read was run. @codex review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 008dc97428
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| guard url.scheme?.lowercased() == "https" else { return nil } | ||
|
|
||
| var mutable = request | ||
| let originalHost = self.dashboardURL.host ?? "home.qwencloud.com" |
There was a problem hiding this comment.
When fetchUsage is exercised with QWEN_CLOUD_HOST/QWEN_CLOUD_QUOTA_URL pointing at a test or proxy host, any same-host HTTPS redirect is compared against the process-default dashboard host instead of the host from the current fetch environment/request. In those override runs, the redirect helper treats the redirected request as cross-host and strips the Cookie header, so a harmless canonical/locale redirect on the overridden endpoint can make the sec-token preflight or API call look logged out.
Useful? React with 👍 / 👎.
|
Follow-up fix pushed in 6026fd0 after testing against the current Brave session shape.
|
|
Live real-account proof is now included in the PR body. The final packaged, stable-signed PR build successfully used the current Brave session, resolved the Qwen Exact account usage, reset timestamps, cookie data, identity, request IDs, and response bodies remain redacted. The final-head shared Alibaba path was rechecked: 37 tests in 8 suites passed. @clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
… shared OneConsole type The Qwen Cloud provider already piggybacks on AlibabaCodingPlanCookieImporter's generic importSession(browserDetection:domains:isAuthenticatedSession:logPrefix:sessionLabel:logger:) entry point. Today that generic overload lives inside the Alibaba module path, which makes the shared-ness implicit and forces Qwen to reach into a sibling provider's namespace. Move the generic implementation -- SessionInfo, importSession, hasSession, cookieImportCandidates, matchesCookieDomain, normalizeCookieDomain -- into a new Providers/Shared/AliyunOneConsole/AliyunOneConsoleCookieImporter.swift. Keep AlibabaCodingPlanCookieImporter as a thin Alibaba-specific wrapper that declares the cookie domains and ticket predicate, and re-export SessionInfo as a typealias so existing call sites compile unchanged. QwenCloudCookieImporter now calls AliyunOneConsoleCookieImporter directly instead of going through the Alibaba namespace. The Alibaba-specific Chromium fallback importer (AlibabaChromiumCookieFallbackImporter) stays in the Alibaba module because it carries Alibaba ticket-name knowledge. AliyunOneConsoleCookieImporter delegates to it. No behavior change. Verified: - swift test --filter AlibabaCodingPlan: 58 tests passed - swift test --filter AlibabaTokenPlan: 37 tests passed - swift test --filter QwenCloud: 27 tests passed - make check: 0 violations
…ba + Qwen copies AlibabaTokenPlanCookieHeaders and QwenCloudCookieHeaders are byte-for-byte identical apart from the two cached-header name constants. The HTTPCookie -> scoped-Cookie-header builder (matchesRequestURL, cookieSortKey, by-name merge) and the duplicated '[String].uniquedSorted()' extension also live in both provider files. Promote a generic OneConsoleCookieHeaders and OneConsoleCookieHeaderBuilder under Providers/Shared/AliyunOneConsole/. Each provider declares its cache namespace (alibaba_token_plan, qwen_cloud) via a typed initializer on the shared struct and routes cached-header round-trips through it. AlibabaTokenPlanCookieHeaders and QwenCloudCookieHeaders become typealiases of OneConsoleCookieHeaders, so all existing call sites continue to compile. The cached-header initializer argument is now namespaced (alibabaTokenPlanCachedHeader:, qwenCloudCachedHeader:) to avoid the collision that would otherwise require the same init? across two extensions. Drop the three duplicate '[String].uniquedSorted()' fileprivate extensions (AlibabaTokenPlanProviderDescriptor, AlibabaTokenPlanUsageFetcher, QwenCloudProviderDescriptor, QwenCloudUsageFetcher) now that the shared type owns one copy. No behavior change. Verified: - swift test --filter AlibabaCodingPlan: 58 tests passed - swift test --filter AlibabaTokenPlan: 37 tests passed - swift test --filter QwenCloud: 27 tests passed - make check: 0 violations
expandEmbeddedJSON, findObject, number, percentagePoints, and date parsing live as private statics in QwenCloudUsageFetcher, with near-identical implementations duplicated in AlibabaCodingPlanUsageFetcher and AlibabaTokenPlanUsageFetcher. Pull them into Providers/Shared/AliyunOneConsole/OneConsoleJSON.swift and route QwenCloudUsageFetcher through the shared helpers. AlibabaCodingPlan and AlibabaTokenPlan migrate in follow-up commits so this one stays a pure refactor. This commit only refactors QwenCloudUsageFetcher; it preserves the existing recursive shape (findObject returns the first dictionary whose keys overlap any of the search set) so all 27 QwenCloud tests continue to pass without modification. No behavior change. Verified: - swift test --filter QwenCloud: 27 tests passed - make check: 0 violations
Dashboard HTML extraction, user-info JSON fallback, and sec_token cookie lookup live as private statics in QwenCloudUsageFetcher (172 lines) with near-identical logic in AlibabaCodingPlanUsageFetcher (90+ lines). Pull the chain into Providers/Shared/AliyunOneConsole/OneConsoleSECTokenResolver.swift. Providers configure the chain via Configuration: dashboardURL closure, userInfoPath, loginPageSniffers, and any extra HTML regex patterns they want to try. QwenCloudUsageFetcher now declares a single static resolver and routes through it. The previous 172-line block (resolveSECSessionToken + fetchSECSessionTokenFromDashboard + fetchSECSessionTokenFromUserInfo + extractSECSessionToken + matchFirstGroup + secTokenCookieValue + looksLikeLoginPage) collapses to one call. The source label (dashboard-html / cookie / user-info) is preserved so existing log metadata is unchanged. AlibabaCodingPlan and AlibabaTokenPlan migrate in follow-up commits so this one stays a pure refactor. No behavior change. Verified: - swift test --filter AlibabaCodingPlan: 58 tests passed - swift test --filter AlibabaTokenPlan: 37 tests passed - swift test --filter QwenCloud: 27 tests passed - make check: 0 violations
Move the five Qwen Cloud parser-response JSON blobs into Tests/CodexBarTests/Fixtures/QwenCloud/*.json so reviewers can replay the captured payloads offline and the test file no longer carries inline 60-line response fixtures. Fixture loader uses Bundle.module.url(forResource:withExtension:subdirectory:), the same pattern already in use by AgentSessionParserTests and ModelsDevPricingTests. The no_active_subscription.json fixture is the live captured response from PR steipete#2361; it guards against the parser reporting a false 100% remaining bar on authenticated accounts without an active token plan. Verified: - swift test --filter QwenCloud: 27 tests passed - make check: 0 violations
Add an Aliyun OneConsole family section to docs/providers.md that lists the shared plumbing under Sources/CodexBarCore/Providers/Shared/AliyunOneConsole/ and explains what each provider still owns vs what it reuses. This gives the next OneConsole-based provider (Tongyi, Bailian China, …) a single place to learn the integration shape. No code change. Verified: - make check: 0 violations
|
Final head All six prior actionable review threads are addressed:
Additional hardening covers cross-origin credential/body forwarding, login-page and missing-token Final-head verification:
The full-suite SpendDashboard host-baseline failure is documented precisely in the PR body and is @codex review |
|
🦞👀 Command router queued. I will update this comment with the next step. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b5f9b6cfae
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| static let browserOrder: BrowserCookieImportOrder = [ | ||
| .chrome, | ||
| .chromeBeta, | ||
| .brave, | ||
| .edge, |
There was a problem hiding this comment.
Because this browserOrder is passed to QwenCloudCookieImport.importSession, an automatic Qwen refresh still falls through to Chrome Beta/Brave/Edge/Arc/Firefox/Safari whenever Chrome has no valid session, even though the descriptor advertises Chrome-only import. In that scenario users can still get prompted for other browser cookie stores, which is the behavior the Chrome-only hardening was meant to avoid; keep the automatic order to [.chrome] unless an explicit override supplies more browsers.
AGENTS.md reference: AGENTS.md:L48-L48
Useful? React with 👍 / 👎.
|
Latest Codex P2 is fixed at head
@codex review |
|
🦞👀 Command router queued. I will update this comment with the next step. |
clawsweeper
Bot
added
rating: 🦐 gold shrimp
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 529cc6c248
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
# Conflicts: # CHANGELOG.md
clawsweeper
Bot
added
rating: 🦪 silver shellfish
clawsweeper
Bot
added
rating: 🦐 gold shrimp
|
Merged after full verification. Qwen Cloud Individual Token Plan lands as a first-class provider (owner decision), with the shared OneConsole parser repaired during review: date-only |
2 participants
Summary
Adds Qwen Cloud's individual Token Plan as a first-class CodexBar provider.
.qwencloudand CLI nameqwen-cloud(qwencloud,qwen, andqwen-token-planare aliases).Current request flow
QWEN_CLOUD_COOKIE.home.qwencloud.comto resolvesec_token, rejecting login pages and stale sessions.https://cs-data.qwencloud.com/data/api.json?action=IntlBroadScopeAspnGateway&product=sfm_bailian.zeldaHttp.apikeyMgr./tokenplan/personal/api/v2/usagezeldaHttp.apikeyMgr./tokenplan/personal/api/v2/subscriptionzeldaHttp.apikeyMgr./tokenplan/personal/api/v2/quota-configsecondary rate windows.
Automatic browser import intentionally defaults to Chrome only, avoiding unrelated browser and
Keychain prompts. Sessions from other browsers can still be supplied through a manual Cookie
header or
QWEN_CLOUD_COOKIE.Shared OneConsole hardening
The final head consolidates the OneConsole behavior shared by Qwen Cloud, Alibaba Coding Plan,
and Alibaba Token Plan while retaining provider-specific authentication and endpoint rules.
sec_tokenhelpers.credentials, and blocks cross-origin 307/308 body forwarding.
sec_tokenasloginRequired.Verification on final head
b5f9b6cfmake check— passed; SwiftFormat reports 0/1,601 files requiring changes and strictSwiftLint reports 0 violations across 1,600 files.
swift test --filter 'AlibabaCodingPlan|AlibabaTokenPlan|QwenCloud|OneConsole'—127 tests in 24 suites passed; the environment-guarded live Qwen smoke test was skipped.
swift test --filter 'QwenCloud|sourceModeRequiresWebSupportAllowsQwenCookiesOnLinuxGate'—29 Qwen tests in 7 suites plus the focused CLI gate test passed.
git diff --check— passed.redactscans — no findings.A full
make testrun was also attempted with the Xcode toolchain and SDK pinned coherently.It reached 49/61 passing shards. Shard 50 then failed only in untouched SpendDashboard suites
with date-window assertions where
totalCostwasnil; the standaloneSpendDashboardControllerTestsreproduces 10 of those failures outside this provider diff.This PR does not modify SpendDashboard.
No live provider request, browser-cookie import, or real Keychain read was run during this
hardening pass.
Historical real-account proof
The live endpoint contract was verified on July 22, 2026 at head
6026fd0awith a packaged,Developer ID-signed build and the contributor's Qwen Cloud account. The build:
sec_token;cs-data.qwencloud.com;Always Allow approval.
Redacted CLI receipt:
Redacted request-path receipt from the same run:
Cookie values and names, account identity, request IDs, exact usage, reset timestamps, and raw
response bodies remain redacted. The unredacted 495-byte JSON result recorded at the time had
SHA-256
68c4b1aa77a568c4661ca90d8e1b16d99aafb903157bf6c2f4e63d2a5b580b49.