Add Bailian CLI token plan usage source

[Hek846]

Summary

• add a Bailian CLI quota fetcher using bl usage token-plan --output json
• add Auto (browser cookies → CLI), CLI, and Web source modes
• preserve existing browser-cookie-first behavior for current Auto users
• map the existing Alibaba region setting to the CLI console region/site arguments
• parse the 5-hour and weekly windows independently
• add settings persistence, source labels, and parser/routing/UI tests

Compatibility and safety

Auto keeps the existing browser-cookie path first and falls back to the signed-in Bailian CLI only when Web fails. Explicit CLI and Web modes remain strict.

The CLI is invoked with an argv array through the existing bounded subprocess runner, with a 15-second timeout and a 64 KiB output cap. Only the four documented quota/reset fields are parsed. Missing CLI, authentication, network, and unsupported-output failures remain sanitized without exposing raw diagnostics or CLI configuration.

Task cancellation remains cancellation rather than being surfaced as an authentication error.

Redacted real behavior proof

Environment: signed-in domestic Personal Token Plan account, cn-beijing, Bailian CLI 1.16.0. An upgrade to 1.17.0 was attempted, but npm refused to overwrite an existing ~/.local/bin/bl; no files or credentials were changed by that attempt.

Command:

bl usage token-plan \
  --console-region cn-beijing \
  --console-site domestic \
  --output json

Redacted observed shape:

{
  "per5HourPercentage": "<omitted>",
  "per5HourResetTime": "<omitted>",
  "per1WeekPercentage": "<number>",
  "per1WeekResetTime": "<number>"
}

This confirms the real CLI may return either window independently.

The built CodexBar CLI consumed the same signed-in session:

.build/debug/CodexBarCLI usage \
  --provider alibaba-token-plan \
  --source cli \
  --format json

Redacted result:

{
  "provider": "alibabatokenplan",
  "source": "cli",
  "primaryPresent": false,
  "secondary": {
    "usedPercent": "<redacted-number>",
    "resetsAt": "<redacted-ISO8601>",
    "windowMinutes": 10080
  }
}

A second real run with --source auto resolved to source: "cli" with a valid secondary window, demonstrating browser-first Auto successfully falling through to the CLI source on this setup. Focused routing coverage asserts the ordered strategies are Web → CLI and that Web falls back only in Auto mode.

Validation

• make check
• swift test --filter AlibabaTokenPlan — 58 tests in 9 suites passed
• full make test during implementation — 906 selections across 76 groups passed
• git diff --check

Closes #3020

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 21, 2026, 3:43 PM ET / 19:43 UTC.

ClawSweeper review

What this changes

Adds Bailian CLI quota retrieval as an explicit source and an explicitly selected Auto fallback for Alibaba Token Plan, with source settings, parsing, CLI routing, and regression tests.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: the latest head addresses the prior compatibility and environment-isolation blockers, with no new correctness finding. Owner sign-off is still required because this adds an authenticated third-party CLI path affecting provider privacy behavior.

Priority: P2
Reviewed head: 7ea2e12a1c0a83f28e35669b8fe9d6d38507dafe
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, well-tested patch with credible redacted runtime evidence; only owner policy approval remains.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): Redacted terminal evidence shows a real signed-in Bailian CLI response, CodexBar’s explicit CLI parsing, and Auto resolving to the CLI fallback; private values were redacted.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): Redacted terminal evidence shows a real signed-in Bailian CLI response, CodexBar’s explicit CLI parsing, and Auto resolving to the CLI fallback; private values were redacted.
Evidence reviewed	8 items	Current main lacks this capability: Current main exposes only Auto and Web source modes, and its Alibaba resolver only returns the web strategy; the requested Bailian CLI route is therefore not already implemented. Bounded subprocess boundary: The PR invokes an absolute resolved executable with an argv array, a 15-second timeout, a 64 KiB output cap, and a strict child-environment allowlist. Legacy behavior is preserved: Unset Alibaba Token Plan source configuration resolves to Web-only; only an explicit Auto selection persists the Web-to-CLI fallback.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s Alibaba Token Plan provider turns configured local sources into quota snapshots used by the menu bar and cross-platform CLI. This PR adds a signed-in Bailian CLI route beside the browser-cookie route and labels the resolved source in those outputs.

flowchart LR
A[Provider settings] --> B[Source selection]
B --> C[Browser-cookie route]
B --> D[Bailian CLI route]
C --> E[Quota snapshot]
D --> E
E --> F[Menu bar and CLI output]

Loading

Decision needed

Question	Recommendation
Should CodexBar accept an explicitly selected Bailian CLI source, including Auto fallback, that uses the user’s existing CLI sign-in state?	Approve the explicit CLI source: Accept the opt-in Web-to-CLI fallback because legacy configurations remain Web-only and the subprocess receives only the documented allowlisted environment.

Why: The implementation is bounded and the contributor supplied real proof, but VISION.md reserves provider-auth and privacy behavior changes for owner sign-off.

Before merge

• Resolve merge risk (P1) - If approved, an explicit CLI or Auto choice permits CodexBar to invoke the user’s signed-in Bailian CLI and read its CLI-managed sign-in state through HOME; this is intentionally bounded but falls under VISION’s provider-auth/privacy sign-off policy.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Implementation and regression coverage	production +278/-13, tests +349/-4	The provider-source addition has more focused regression coverage than production growth across nine changed files.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3020
Summary: This PR is the concrete candidate implementation for the linked Bailian CLI quota-source request.

Members:

• canonical: Bailian CLI exposes Token Plan quota via bl usage token-plan #3020 - The PR body explicitly identifies this issue as the feature request implemented by the branch.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Approve the opt-in source boundary (recommended)
   Accept the explicit CLI and Auto modes with the preserved legacy Web-only default and environment allowlist.
2. Restrict the fallback policy
   Require a CLI-only mode or another narrower consent boundary before merging if automatic fallback is not desired.
3. Pause for provider-policy direction
   Leave the PR open until an owner decides whether a signed-in third-party CLI is an acceptable source.

Technical review

Best possible solution:

Land the narrow descriptor-based source only after the owner confirms that explicit Web-to-CLI fallback is acceptable, retaining legacy Web-only behavior and the child-environment allowlist.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a feature request; the contributor nevertheless supplied high-confidence redacted after-fix terminal evidence for explicit CLI mode and Auto fallback.

Is this the best way to solve the issue?

Yes technically: this follows the existing descriptor, strategy, settings, and test seams without a dependency or new config schema. Product acceptance still requires the VISION.md sign-off for authenticated provider behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f74117aeb7a9.

Labels

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): Redacted terminal evidence shows a real signed-in Bailian CLI response, CodexBar’s explicit CLI parsing, and Auto resolving to the CLI fallback; private values were redacted.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P2: This is a bounded provider-source enhancement with limited impact to Alibaba Token Plan users.
• merge-risk: 🚨 compatibility: Saved source selection and fallback behavior can affect existing provider configurations.
• merge-risk: 🚨 auth-provider: The change reads quota through the user’s authenticated Bailian CLI session.
• merge-risk: 🚨 security-boundary: The patch launches an external executable and deliberately controls which environment values cross that boundary.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): Redacted terminal evidence shows a real signed-in Bailian CLI response, CodexBar’s explicit CLI parsing, and Auto resolving to the CLI fallback; private values were redacted.
• proof: sufficient: Contributor real behavior proof is sufficient. Redacted terminal evidence shows a real signed-in Bailian CLI response, CodexBar’s explicit CLI parsing, and Auto resolving to the CLI fallback; private values were redacted.

Evidence

What I checked:

• Current main lacks this capability: Current main exposes only Auto and Web source modes, and its Alibaba resolver only returns the web strategy; the requested Bailian CLI route is therefore not already implemented. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift:101, f74117aeb7a9)
• Bounded subprocess boundary: The PR invokes an absolute resolved executable with an argv array, a 15-second timeout, a 64 KiB output cap, and a strict child-environment allowlist. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanCLIUsageFetcher.swift:69, 7ea2e12a1c0a)
• Legacy behavior is preserved: Unset Alibaba Token Plan source configuration resolves to Web-only; only an explicit Auto selection persists the Web-to-CLI fallback. (Sources/CodexBar/Providers/Alibaba/AlibabaTokenPlanSettingsStore.swift:6, 7ea2e12a1c0a)
• Focused coverage exercises the sensitive paths: Tests cover actual child-process environment isolation, cancellation, independent quota windows, legacy Web-only routing, explicit Auto routing, and settings persistence. (Tests/CodexBarTests/AlibabaTokenPlanProviderTests.swift:1020, 7ea2e12a1c0a)
• Real behavior proof: The PR body supplies redacted after-fix output from a signed-in Bailian CLI, CodexBar explicit CLI mode, and an Auto run that resolved to CLI. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanCLIUsageFetcher.swift:101, 7ea2e12a1c0a)
• Feature ownership history: Blame attributes the descriptor and app implementation on current main to Peter Steinberger; history also shows Peter’s Alibaba personal-variant introduction and later descriptor/CLI architecture refactors. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift:101, 20d54c0094a3)

Likely related people:

• steipete: Current-main blame assigns the Alibaba descriptor and app implementation to Peter Steinberger, who also introduced personal variants and led the surrounding provider-descriptor and CLI architecture work. (role: feature-history owner and likely sign-off owner; confidence: high; commits: 20d54c0094a3, 0535e0914cb9, d96e1822f856; files: Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift, Sources/CodexBar/Providers/Alibaba/AlibabaTokenPlanProviderImplementation.swift)
• wait2050: Recent merged Alibaba Token Plan work corrected personal-account request behavior in the same provider descriptor. (role: recent adjacent contributor; confidence: medium; commits: 4482118b7a5f; files: Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanProviderDescriptor.swift)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-08-19T21:49:49.390Z sha d7dd4b8 :: needs real behavior proof before merge. :: [P1] Preserve the existing Auto source order
• reviewed 2026-08-20T00:49:59.574Z sha 1f7ab22 :: found issues before merge. :: [P1] Allowlist the environment sent to Bailian CLI | [P1] Preserve existing Auto semantics until users opt in

[Hek846]

Addressed the compatibility finding in commit 1f7ab22:

• Auto now preserves the existing browser-cookie-first order and falls back to Bailian CLI only when Web fails.
• Explicit Web and CLI modes remain strict.
• Focused routing coverage verifies Web → CLI and Auto-only fallback.
• The PR body now includes redacted proof from a real signed-in bl usage token-plan run, successful CodexBar explicit CLI parsing, and a successful real Auto fallback to CLI.

All 58 Alibaba Token Plan tests and make check pass.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[Hek846]

Addressed the two blocking review points in 7ea2e12a:

• The Bailian bl subprocess now receives a strict allowlist (PATH/HOME, locale/timezone, and proxy variables); ambient cookies, API keys, cloud credentials, CI variables, and other secrets are excluded.
• Legacy Alibaba Token Plan configs with an unset source remain Web-only in both the app and CLI. Explicitly selecting Auto is persisted as .auto and opts into Web → CLI fallback.
• Added unit and real stub-subprocess coverage for environment isolation, plus app/settings/CLI regression coverage for legacy versus explicit Auto behavior.

Validation:

• make check — passed (0 violations)
• make test — all 906 selections across 76 groups passed; 0 retries/failures
• Qwen implemented the change; Claude independently reviewed the six-file diff and found no merge blockers.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.