[codex] Add Doubao coding plan usage#1727
Conversation
|
OpenCLI follow-up notes for reviewers:
Validation already run locally:
|
The signer emitted canonical headers / SignedHeaders as host;x-date;x-content-sha256;content-type. Volcengine V4 (AWS SigV4 derived) requires them sorted by lower-cased header name, and the server re-sorts + recomputes the signature, so the unsorted order would yield a signature mismatch (HTTP 403) on live GetCodingPlanUsage calls. Sort to content-type;host;x-content-sha256;x-date and update the test expectation. Note: the signing test asserts structure only (no golden vector), so this still needs a live AK/SK request to confirm the server accepts it.
|
Pushed Heads-up: the signing test asserts structure only (credential scope + SignedHeaders string), not a golden signature, so it would not have caught this. A real AK/SK request is still needed to confirm the server accepts the signature end-to-end. The decode/mapping (QuotaUsage session/weekly/monthly → RateWindow) I verified against a live console response and it matches. |
|
Codex review: needs real behavior proof before merge. Reviewed June 25, 2026, 12:12 AM ET / 04:12 UTC. Summary Reproducibility: not applicable. this is a feature/auth-surface PR, not a broken existing contract. Source inspection shows current main lacks GetCodingPlanUsage, and the PR behavior is covered by tests but not by a live signed AK/SK run. Review metrics: 2 noteworthy metrics.
Root-cause cluster Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Land a maintainer-approved version that preserves Ark fallback compatibility, documents the Doubao AK/SK setup, and includes redacted real signed Coding Plan proof before release. Do we have a high-confidence way to reproduce the issue? Not applicable: this is a feature/auth-surface PR, not a broken existing contract. Source inspection shows current main lacks GetCodingPlanUsage, and the PR behavior is covered by tests but not by a live signed AK/SK run. Is this the best way to solve the issue? Unclear until maintainer sign-off and live proof. The implementation is a narrow first-class provider path with compatibility tests, but the Doubao AK/SK credential surface is a product/auth decision. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against ada3660e9d61. Label changesLabel justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
clawsweeper
Bot
added
rating: 🦪 silver shellfish
clawsweeper
Bot
added
rating: 🧂 unranked krab
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eefcab4092
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…plan # Conflicts: # Tests/CodexBarTests/ConfigValidationTests.swift
|
Addressed the current P2 in
Validation:
Proof note: I checked local env/config presence without printing secret values. This machine has Doubao API-key material but no Volcengine AK/SK pair, so I still cannot produce the requested signed Coding Plan live fetch proof here. That still needs real Volcengine AK/SK. @codex review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 22a6bad6d5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
clawsweeper
Bot
added
the
merge-risk: 🚨 security-boundary
|
Addressed the new Ark preservation P2 in
Validation:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: decf7f4f66
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the latest Doubao P2s in
Validation:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b63582afd7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the signed-to-Ark fallback P2 in
Validation:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f17026c97b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the VOLC_* alias P2 in
Validation:
Real Coding Plan proof is still unavailable from this machine because no Volcengine AK/SK env/config credentials are present. @codex review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9678247b12
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the Ark request-label P2 in
Validation:
Real Coding Plan proof is still unavailable from this machine because no Volcengine AK/SK env/config credentials are present. @codex review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d4a1419065
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the Coding Plan reset P2s in
Validation:
Real Coding Plan proof is still unavailable from this machine because no Volcengine AK/SK env/config credentials are present. @codex review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
clawsweeper
Bot
added
rating: 🦪 silver shellfish
Supplemental redacted Coding Plan proofCurrent branch head: This does not replace ClawSweeper's requested after-fix CodexBar signed AK/SK proof, but it narrows the remaining blocker and confirms the live Coding Plan response shape the PR implements. What I could verify from this machine today:
{
"observedAt": "2026-06-25T03:58:33Z",
"httpStatus": 200,
"action": "GetCodingPlanUsage",
"version": "2024-01-01",
"service": "ark",
"region": "cn-beijing",
"resultStatus": "Running",
"updatedAt": "2026-06-25 11:58:34 CST",
"quotaUsage": [
{
"level": "session",
"percent": 0.01392,
"resetAt": "2026-06-25 15:46:05 CST"
},
{
"level": "weekly",
"percent": 3.2836043333333333,
"resetAt": "2026-06-29 00:00:00 CST"
},
{
"level": "monthly",
"percent": 7.623784166666667,
"resetAt": "2026-06-25 23:59:59 CST"
}
]
}No cookies, auth headers, account IDs, request IDs, phone/email, raw identity responses, or secrets are included. Remaining decision before this can clear the ClawSweeper gate:
@steipete could you pick the path you want here? I am holding off on another @clawsweeper re-review until there is either signed-path proof or maintainer acceptance of an alternative, to avoid a noisy rerun. |
1 participant
Summary
Fixes #1724.
This adds first-class Doubao Coding Plan usage fetching through Volcengine's signed OpenAPI path while preserving the existing Ark API-key probe as a fallback.
What changed
GetCodingPlanUsage.QuotaUsageinto 5-hour, weekly, and monthly usage windows.Investigation notes
opencliinspection of the Volcengine Ark console showed the Coding Plan page callingGetCodingPlanUsage, returningsession,weekly, andmonthlypercentages plus reset timestamps. The signing implementation follows Volcengine's documented/demo HMAC-SHA256 request shape with thedate/region/service/requestcredential scope.Supplemental live proof
Redacted OpenCLI console-network proof from 2026-06-25 confirmed a successful live Coding Plan response shape from the logged-in Volcengine Ark console:
{ "httpStatus": 200, "action": "GetCodingPlanUsage", "version": "2024-01-01", "service": "ark", "region": "cn-beijing", "resultStatus": "Running", "quotaUsage": [ { "level": "session", "percent": 0.01392 }, { "level": "weekly", "percent": 3.2836043333333333 }, { "level": "monthly", "percent": 7.623784166666667 } ] }No cookies, auth headers, account IDs, request IDs, phone/email, raw identity responses, or secrets are included. The full redacted proof comment is at #1727 (comment).
Remaining ClawSweeper gate: this machine only has an Ark bearer token, not Volcengine AK/SK credentials, so it cannot yet produce the requested after-fix CodexBar signed-path run. Maintainer decision needed: provide/approve a temporary AK/SK proof path, accept the console-proxy proof plus tests as sufficient, or pause/reject the Doubao-specific AK/SK credential surface.
Validation
make checkswift test --filter 'Doubao|ProviderConfigEnvironment|ConfigValidation'swift run CodexBarCLI usage --provider doubao --source auto --jsonwith Ark fallback present and no error