Skip to content

Sync upstream through b036579b4 - #96

Merged
ColumbusLabs merged 210 commits into
mainfrom
automation/upstream-sync-94-20260729
Jul 29, 2026
Merged

Sync upstream through b036579b4#96
ColumbusLabs merged 210 commits into
mainfrom
automation/upstream-sync-94-20260729

Conversation

@ColumbusLabs

Copy link
Copy Markdown
Owner

Summary

Syncs Pete upstream range fcf75fb80457eaf1722194124a614f0ec7ebcde8..b036579b4b055bac16033f74481ee1ff26cc1317 (28 non-merge commits; 38 total commits) and closes #94.

The preceding unchanged-tree ancestry merge records fcf75fb80 as integrated because the prior connector-created sync commit preserved the tree but omitted the upstream parent. The reviewed merge then has b036579b4 as its exact second parent.

Risk review

  • Provider/auth/security: endpoint override validation, LiteLLM/LLM Proxy secret safety, Doubao Agent Plan, OpenCode Go web overlay, Ollama token-account cookies, MiniMax Linux API-key behavior, Claude OAuth account handling.
  • Quota/cost/calendar: calendar preservation, timezone invalidation, non-Gregorian dates, cache schema/version changes, Pi and Codex scan behavior.
  • Runtime/CLI/menu: CLI version path handling, provider web-support gating, menu recovery/state and layout changes.
  • Branding/release: preserved QuotaKit and Columbus Labs public identity, Columbus Labs appcast/release ownership, About URL, shipped version/build values, and QuotaKit config paths. No mobile, widget, Shared, CloudKit, or iOS build-number files changed.

QuotaKit adaptations

  • Kept ~/.quotakit guidance and QuotaKit CLI version assertions.
  • Preserved ZoomMate manual-cookie capture exemption and Qwen credential behavior while adding MiniMax Linux API-key support.
  • Kept QuotaKit appcast, release versions, and Columbus Labs website ownership.
  • Advanced only UPSTREAM_MONITOR_BASE to b036579b4b055bac16033f74481ee1ff26cc1317 and regenerated the Codex parser hash.

Validation

  • git diff --check
  • swift build
  • focused Swift tests: 431 tests in 16 suites, 0 failures; CLI XCTest 27 passed
  • PARSER_LINT_BASE=origin/main ./Scripts/lint.sh lint
  • make test: 794 selections in 67 groups, 67 passed, 0 retries or timeouts

No live provider or Keychain probes were run.

OfficialAbhinavSingh and others added 30 commits July 19, 2026 19:32
parseSnapshot computed nextResetAt as the globally earliest reset time
(quotaGroups.compactMap { parseDate }.min()) with no future filter, so a
stale already-elapsed reset_time could be surfaced as the next reset.
Filter to reset times after the snapshot updatedAt before taking the
minimum, mirroring GrokWebBillingFetcher and ClaudeStatusProbe.
ZaiLimitEntry.usedPercent returns computedUsedPercent (already clamped)
when quota fields are present, but the fallback returned self.percentage
raw. z.ai omits/misreports quota fields, so an out-of-range API
percentage flowed unclamped into RateWindow.usedPercent. Clamp the
fallback like computedUsedPercent and sibling providers.
Windsurf (web + cached), Zed, and JetBrains each format their reset
countdown with if hours > 24, so a reset exactly 24h out fell through to
the hours branch and rendered '24h 0m' / 'Cycle ends in 24h 0m' - the
'1d 0h' day form was unreachable. Change to hours >= 24 in all four,
matching UsageFormatter.resetCountdownDescription. Inject now (default
Date()) so the formatters are unit-testable, mirroring the canonical
formatter's signature.
Add a fully-wired "Qwen Cloud" provider that tracks the individual token
plan subscription on https://home.qwencloud.com/billing/subscription/token-plan-individual
(the plan that grants hosted Claude access), alongside all existing settings.

Qwen Cloud shares the Aliyun one-console auth + BssOpenAPI gateway used by
the Alibaba token plan, so it reuses that parser/cookie plumbing:

- New provider `.qwencloud` (CLI name `qwen-cloud`, aliases qwencloud/qwen/
  qwen-token-plan) with descriptor, web fetch strategy, monochrome icon, and
  a curated confetti palette.
- QwenCloudUsageFetcher posts form-encoded GetSubscriptionSummary
  (BssOpenAPI-V3, productCode sfm_tokenplansolo_public_intl) after resolving
  sec_token from the dashboard HTML, the sec_token cookie, or /tool/user/info.json.
- URL-scoped cookie headers for qwencloud.com plus a browser cookie importer
  over the qwencloud/alibabacloud/aliyun passport domains.
- Settings UI (cookie source picker + manual Cookie header + "Open Token Plan"
  link), CLI (`codexbar usage --provider qwen-cloud`), diagnostics, widget,
  and docs (docs/qwen-cloud.md, README, providers.md, configuration.md).
- Generalized AlibabaCodingPlanCookieImporter.importSession to accept a
  provider-specific domain list + session validator so Qwen Cloud can reuse it;
  the existing Alibaba behavior is unchanged (delegates with its own defaults).
- Extended the Alibaba token-plan parser to read nested EquityList quota fields
  (CycleTotalValue/CycleSurplusValue/EndTime) without changing existing results.

Tests: parser/snapshot/cookie-header/stub-fetch/import-validation suites plus
an opt-in live smoke test (disabled by default; gated on QWEN_CLOUD_LIVE_TEST=1
and QWEN_CLOUD_COOKIE) so CI never touches the network or Keychain.
…alize bare host overrides

Review follow-ups for #2361:

- Cookie import now treats only login_aliyunid_ticket / qwen_sso_ticket as
  proof of an authenticated session. Locale prefs, account-id markers, and
  CSRF cookies scoped to qwencloud.com no longer select browser profiles
  that merely visited the site, which previously caused ticketless requests,
  loginRequired responses, and re-import loops.
- QWEN_CLOUD_HOST now accepts bare hosts (e.g. qwen-cloud.test or
  qwen-cloud.test:8443) and normalizes them to HTTPS via the shared
  endpoint-override validator, matching the Alibaba token-plan host
  override, so dashboard/quota URLs and the Origin header stay valid.
- Adds regression tests for both paths and documents the bare-host form.
…ption response

Captures a real-world subscription-summary response from
home.qwencloud.com for an authenticated account with no active
individual token-plan subscription (TotalCount=0, zeroed quota fields).
The API returns HTTP 200 with Success=true rather than an error, so the
parser must not report a false subscription or synthesize a 100% bar.

Documents the actual contract encountered in production so future
parser changes can be checked against it. Verified end-to-end:

    $ codexbar usage --provider qwen-cloud --source web --log-level verbose
    -> Cookie cache hit
    -> dashboard HTML 200 (18 kB)
    -> /tool/user/info.json 200 (sec_token resolved)
    -> GetSubscriptionSummary 200 (451 B, TotalCount=0)

Parser yields an empty primary window (no false quota) and an identity
loginMethod of "TOKEN PLAN", matching the user-visible label.

Complements the existing TotalCount=1 / TotalValue>0 fixtures.
Cursor refreshes failed with “session changed” because Keychain store/load
could not persist under Disable Keychain access. Use an in-process fallback
and clear it when the setting is toggled.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Clock rollover tests called selectDays(7) on UserDefaults.standard,
which leaked into later ControllerTests and, once wall-clock moved past
the Jul 15 fixtures, made totalCost nil under a 7-day window.

Co-authored-by: Cursor <cursoragent@cursor.com>
Local test build: keep in-memory cookie caches when Keychain is disabled,
and ignore Claude Fable/scoped weeklies on the overview switcher bar.

Co-authored-by: Cursor <cursoragent@cursor.com>
Background Auto previously gated off Claude CLI whenever Keychain access
was disabled, so cold start had no OAuth/web cookies and no CLI until a
manual Refresh. Keep CLI available on that path and skip auth-status
preflight so boot does not probe Keychain via the child process.

Co-authored-by: Cursor <cursoragent@cursor.com>
steipete and others added 19 commits July 29, 2026 07:41
…xy-endpoint-validation

fix: validate LiteLLM and LLM Proxy base URLs before sending the API key
The `.api` source signs `GetCodingPlanUsage`, which only covers a Coding
Plan. An account holds a Coding Plan *or* an Agent Plan, so an Agent Plan
account's Coding Plan is reclaimed and the endpoint returns Status only,
with no `QuotaUsage`. That made the strict decode throw ("Failed to parse
Doubao response"), leaving the account with no usage.

Decode a quota-less Coding Plan result as empty instead of failing, and
when the Coding Plan carries no active quota, fall back to the sibling
`GetAFPUsage` action (same AK/SK signing, version, and region). Its AFP
5-hour/weekly/monthly windows map onto the existing `agent_*` rate-window
levels, so the `.api` and arkcli `.cli` paths render an Agent Plan account
identically — without needing arkcli installed or an SSO login.

The fallback fires only on a 200 whose Coding Plan has no active quota;
hard errors still surface as-is, and an active Coding Plan is returned
without the extra request.
…-usage-dates

Fix cost history dates for non-Gregorian calendars
…api-key

fix: allow MiniMax usage on Linux with a configured API key
Doubao: read Agent Plan (AFP) usage on the AK/SK API source
fix: overlay authoritative OpenCode Go web windows onto local usage
@cursor

cursor Bot commented Jul 29, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@ColumbusLabs
ColumbusLabs merged commit 08a0972 into main Jul 29, 2026
9 checks passed
@ColumbusLabs
ColumbusLabs deleted the automation/upstream-sync-94-20260729 branch July 29, 2026 20:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upstream Changes Available for Review