Show Grok usage-limit reset coupons - #3188
Conversation
|
You have reached your Codex usage limits for security reviews. Please try again later. |
|
🦞👀 Pull request received. I will update this pull request when review starts. |
clawsweeper
Bot
added
merge-risk: 🚨 auth-provider
|
Codex review: needs maintainer review before merge. Reviewed August 29, 2026, 11:35 AM ET / 15:35 UTC. ClawSweeper reviewWhat this changesThis PR fetches unused Grok usage-limit reset coupons through a read-only Grok billing RPC and displays their count and expiry alongside weekly usage without delaying the primary refresh. Merge readinessKeep open for owner sign-off: the implementation is coherent, resolves the prior cross-provider persistence concern, and has direct packaged-app proof, but it adds a new authenticated Grok provider capability whose approval is explicitly still pending. Priority: P2 Review scores
Verification
How this fits togetherCodexBar refreshes provider usage through provider-specific strategies and turns the resulting snapshot into menu-bar cards. This change adds an optional Grok coupon lookup, then applies its result to the live usage snapshot and shared reset-credit presentation. flowchart LR
A[Provider refresh] --> B[Grok billing strategy]
B --> C[Winning OAuth or cookie context]
C --> D[Remaining-reset lookup]
D --> E[Supplemental live snapshot]
E --> F[Shared reset-credit presentation]
F --> G[Menu bar and settings cards]
Decision needed
Why: VISION.md requires sign-off for new features and behavior affecting provider authentication or privacy, and the owner's review explicitly withheld approval of this coupon feature. Before merge
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Land the bounded, credential-scoped lookup only after explicit approval that CodexBar should maintain this Grok provider capability; otherwise retain the existing weekly-usage behavior without the extra RPC. Do we have a high-confidence way to reproduce the issue? Not applicable as a bug reproduction: this PR adds a new capability, and its supplied packaged-app screenshot directly demonstrates the intended Grok card result. Is this the best way to solve the issue? Unclear: the implementation follows the existing provider strategy and shared UI patterns, but VISION.md requires owner sign-off before accepting this new authenticated provider behavior. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 7d502b9eb183. LabelsLabel justifications:
EvidenceWhat I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (7 earlier review cycles)
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd39a4ac1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
dd39a4a to
4583904
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4583904361
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the review feedback in
Live proof from the packaged debug app against a real Grok account (account data and tokens redacted): 
The weekly card remains available immediately; the reset-credit block then shows Validation: 47 affected tests across 7 suites pass, @clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
proof: 📸 screenshot
4583904 to
2f4ddc4
Compare
clawsweeper
Bot
added
rating: 🐚 platinum hermit
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f4ddc468a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c094bb7b93
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
clawsweeper
Bot
added
rating: 🦐 gold shrimp
clawsweeper
Bot
added
status: ⏳ waiting on author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 93d631e64b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a3188cc675
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
steipete
left a comment
steipete
left a comment
There was a problem hiding this comment.
The winning-cookie path has improved, but a5b8a152a5defae78b0cb691a8fd0ab6ff983031 still does not bind OAuth billing, identity, plan and reset inventory to one captured account context.
GrokOAuthFetchStrategy.fetch captures credentials for billing, then its shared wrapper independently reads authCredentials. After awaiting billing, the wrapper reads the auth file again for identity, while reset lookup uses its earlier authCredentials. If a login replaces temporary account A with B during the awaited billing call, the result can contain A's usage and coupons with B's identity. A switch between the first two reads can instead give billing and coupons different credentials. GrokUsageSnapshot.toUsageSnapshot takes identity from the supplied credentials, and credentialsForSnapshot retains them after successful billing; neither repairs that mismatch.
The post-await identity reread already exists on main; the new inventory path inherits and extends the same ownership gap. Please carry the credentials that actually won billing through identity, tier and coupon enrichment, keeping cookie-backed results separate. Add a suspended fake-billing regression that changes only a temporary auth fixture during the await and verifies that the returned primary result and supplemental inventory stay bound to the same account. Publication-generation guards cannot repair an already-mixed fetch result.
Keep reset inventory read-only and optional; no redemption is needed for this proof. The supplied earlier-head screenshot is useful, but does not exercise this current-head account-switch case. I inspected the relevant source and existing credential-to-identity mapping; I did not run tests, access an account, or perform a live probe in this pass.
|
@steipete Addressed the account-context ownership gap in
Validation:
|
|
Thanks @Leshabeats. I read the The pre-existing main-branch account-mixing bug is being repaired separately in #3237, without adding reset-coupon inventory or new local-log reads. Its isolated regression failed before the fix and now passes; focused tests, architecture checks, lint, and independent review are green, while the full suite and CI are still running. It is not merged yet. Once #3237 lands, please reconcile this branch with that shared credential-capture boundary and retain the winning-cookie behavior your coupon lookup needs. This acknowledges the source correction, not approval of the coupon feature or a claim that its remaining product and live-proof requirements are complete. |
Weekly CLI-proxy credits omit SuperGrok reset tokens, so CodexBar never rendered an unused coupon even when grok.com listed one. Fetch remaining resets as a best-effort overlay and keep weekly usage if that call fails.
38105e2 to
76f001a
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@steipete Reconciled this branch with the shared credential-capture boundary from #3237 and addressed the remaining P2 in
The remaining gate is owner sign-off on the read-only, fail-soft authenticated Grok |
2 participants
Summary
Limit Reset Creditsdetail row, and leave weekly usage intact if that extra call times out or returns nothingTests
CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 swift test --filter GrokRemainingResetsFetcherTestsCODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 swift test --filter GrokMenuCardModelTestsCODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 swift test --filter GrokCreditsProxyFetcherTestsswiftlint lint --stricton the Grok remaining-resets filesWhy this was missing
/v1/billing?format=creditsreports weekly SuperGrok usage only. grok.com's Использование panel reads unused reset coupons from a separate RPC:POST https://grok.com/prod_mc_billing.ConsumerUiSvc/GetRemainingResetsThat payload includes
token_idandvalidity_end. CodexBar never called it, so an unused coupon such as Доступен сброс / Истекает 12 сент. stayed invisible even when weekly usage was 29%.CodexBar does not redeem or modify reset tokens.