Add LongCat usage provider#1697
Conversation
|
Codex review: needs maintainer review before merge. Reviewed June 24, 2026, 2:28 AM ET / 06:28 UTC. Summary Reproducibility: not applicable. as a new provider feature rather than a bug report. Parser/settings behavior is source-testable, and the contributor now supplied redacted live output from the current PR head. Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Land the provider only if maintainers explicitly accept the disabled-by-default full-cookie web-console boundary; otherwise wait for a documented usage endpoint or narrower LongCat credential. Do we have a high-confidence way to reproduce the issue? Not applicable as a new provider feature rather than a bug report. Parser/settings behavior is source-testable, and the contributor now supplied redacted live output from the current PR head. Is this the best way to solve the issue? Unclear pending maintainer sign-off. The implementation follows existing cookie-backed provider patterns and the previous source-level findings appear repaired, but full-cookie forwarding is a security/product decision rather than an automatic acceptance path. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 2435c93453fe. Label changesLabel changes:
Label justifications:
Evidence reviewedSecurity concerns:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1c5d176640
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
LeoLin990405
force-pushed
the
feat/longcat-provider
branch
from
1c5d176 to
0715e15
Compare
clawsweeper
Bot
added
rating: 🧂 unranked krab
LeoLin990405
force-pushed
the
feat/longcat-provider
branch
from
0715e15 to
8a6c0b4
Compare
Addresses Codex review on steipete#1697: - user-current now propagates envelope auth failures (HTTP 200 + code 401/403 -> .invalidSession) instead of swallowing them with try?, so expired cookies prompt re-auth rather than reporting an empty snapshot. - Remove the never-assigned todayTokens / freeQuota fields and the unreachable tertiary 'Today' window; LongCat's tokenUsage is a quota snapshot with no per-day figure. - Add envelope unit tests (invalid-session + success unwrap).
|
Thanks for the review — both P2s are addressed in
On the cookie import using only the first session: that's intentional parity with the existing Kimi/MiniMax cookie providers (single-account balance read); happy to generalize if you'd prefer. Behavior proofThe field mapping is not guessed — it's locked against live responses captured from a logged-in
{ "code": 0, "message": "SUCCESS",
"data": { "usage": { "totalToken": 500000, "usedToken": 0, "availableToken": 500000 },
"extData": { "LongCat-Flash-Lite": { "totalToken": 50000000, "usedToken": 0 } } } }
@codex review |
Cookie-based web provider for LongCat (Meituan) that surfaces console
token quota (总额度) and fuel-pack balance (加油包) by reading the
longcat.chat platform session, mirroring the Kimi/MiniMax cookie pattern.
Field mapping is locked against captured live responses:
- GET /api/v1/user-current -> data.name
- GET /api/lc-platform/v1/tokenUsage -> data.usage.{total,used,available}Token
- GET /api/lc-platform/v1/pending-fuel-packages -> data.totalQuota + data.list[]
The public API key path exposes no usage endpoint, so usage is read from
the web console session (all longcat.chat cookies are forwarded since the
Meituan passport cookie name is undocumented). The user-current body is
never logged (it carries a session token + phone).
Wires .longcat into the provider/icon enums, descriptor registry, settings
snapshot/builder, implementation registry, logging, widget, cost-usage and
debug switches; adds brand icon, docs provider-id list, CHANGELOG entry and
unit tests covering the live response shapes.
Addresses Codex review on steipete#1697: - user-current now propagates envelope auth failures (HTTP 200 + code 401/403 -> .invalidSession) instead of swallowing them with try?, so expired cookies prompt re-auth rather than reporting an empty snapshot. - Remove the never-assigned todayTokens / freeQuota fields and the unreachable tertiary 'Today' window; LongCat's tokenUsage is a quota snapshot with no per-day figure. - Add envelope unit tests (invalid-session + success unwrap).
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35076321c6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
LeoLin990405
force-pushed
the
feat/longcat-provider
branch
from
3507632 to
ba31d95
Compare
Addresses Codex re-review on steipete#1697: resolveCookieOverride read context.env["LONGCAT_MANUAL_COOKIE"] directly, bypassing LongCatSettingsReader.cookieHeader(), so the lower-case longcat_manual_cookie alias and quote-trimming never reached the env fetch path for CLI/daemon users. Route the env value through the reader first. (The P3 changelog 'today's token usage' wording was already dropped during the rebase onto main.)
|
Re-review follow-up — both findings handled in
Branch is rebased onto latest @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4110e2ae18
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Addresses Codex re-review on steipete#1697 (2 P2): - Off now fully disables web auth: resolveCookieOverride returns nil when cookieSource is .off, so a lingering LONGCAT_MANUAL_COOKIE env value can no longer keep the web strategy available. - Browser cookie/keychain import is gated to the Auto source only; Manual no longer silently falls back to a browser session when the pasted header is missing/invalid (it surfaces as unavailable instead). - Add regression tests for the Off/Auto env-override gating.
|
Both cookie-source findings fixed in
+2 regression tests. @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 670a9d25df
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
clawsweeper
Bot
added
the
merge-risk: 🚨 security-boundary
clawsweeper
Bot
added
rating: 🦐 gold shrimp
|
All Codex review threads have been addressed and resolved. PR body now documents the latest cookie-source guardrails, Chrome-only LongCat auto import default, missing-quota behavior, validation, and the maintainer auth/privacy decision point. @codex review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@openclaw-mantis visual task: verify CodexBar renders LongCat quota and fuel-pack values from a real longcat.chat session with private cookies/account details redacted. |
Redacted live behavior proofRan a local live proof against the current PR head (
No cookie values, auth tokens, account names, phone numbers, IPs, raw response bodies, or endpoint URLs are included below. {
"commit": "5197371d694e8283de0ee0120ab80c9dfceb19ac",
"provider": "longcat",
"runtime": "app",
"interaction": "userInitiated",
"cookieSource": "auto",
"importPolicy": "macOS Chrome-only browser cookie import",
"strategyAvailable": true,
"fetchSource": "web",
"identityPresent": true,
"primaryRendered": true,
"primaryUsedPercent": 0,
"primaryDescription": "0/500000",
"fuelPackEndpointObserved": true,
"fuelPackEndpointTotalQuota": 0,
"fuelPackEndpointPackageCount": 0,
"fuelPackRendered": false,
"timestamp": "2026-06-24T06:22:54Z"
}Notes:
Maintainer sign-off still requested: this PR intentionally forwards the full @clawsweeper re-review |
clawsweeper
Bot
added
proof: sufficient
|
Maintainer sign-off requested for the final ClawSweeper gate. The remaining decision is whether CodexBar core accepts forwarding the full
@steipete could you explicitly confirm whether this full-cookie boundary is acceptable for merge? |
1 participant
What
Adds LongCat (Meituan) as a disabled-by-default usage provider, surfacing token quota (总额度) and fuel-pack balance (加油包) in the menu bar / Overview.
Why this is a cookie provider
LongCat's public OpenAI/Anthropic-compatible API (
api.longcat.chat) exposes no usage/balance/quota endpoint: billing/usage paths return 404 and responses carry no useful rate-limit headers. Usage is only available from the web console (longcat.chat) session, so this mirrors the existing Kimi / MiniMax cookie providers.Supported auth sources:
Cookie:header via settings/env.longcat.chat.Auth and privacy boundary
Maintainer decision requested: this intentionally forwards the full
longcat.chatcookie header because the Meituan-passport auth cookie name is undocumented. If that boundary is not acceptable, this should wait for a documented LongCat usage endpoint or a narrower supported auth token.Current guardrails:
Offdisables web auth entirely, including lingering env cookies.Manualonly uses the pasted/manual cookie header and does not import browser cookies.Autocookie source.user-currentresponse bodies are never logged because they can include a session token and phone number.Endpoints and mapping (verified against redacted live response shapes)
GET /api/v1/user-currentdata.name(account)GET /api/lc-platform/v1/tokenUsagedata.usage.{totalToken, usedToken, availableToken}GET /api/lc-platform/v1/pending-fuel-packagesdata.totalQuota+data.list[]Mapping behavior:
primarynil instead of rendering a fake 0% window.user-currentsurface as invalid-session errors, so expired cookies prompt re-auth instead of an empty successful snapshot.Review follow-up
Addressed Codex review findings:
LongCatSettingsReaderfor lower-case alias and quote trimming.Offbefore env-cookie fallback.Manualfrom importing browser cookies.Wiring
.longcatadded toUsageProvider/IconStyle, descriptor registry, settings snapshot + builder, implementation registry, logging categories, widget metadata, cost-usage scanner, debug-log switch, provider icon,docs/configuration.mdprovider-id list, and focused unit tests covering the redacted live response shapes and cookie-source behavior.Testing
swift test --filter 'LongCat|BrowserCookieOrder'✅ (28 tests)make check✅changes,lint, Linux x64/arm64 builds, macOS shards 0-3,lint-build-test, GitGuardian)