🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

Codex review: needs real behavior proof before merge. Reviewed August 23, 2026, 6:39 AM ET / 10:39 UTC.

ClawSweeper review

What this changes

This PR replaces Grok context-occupancy estimates with bounded completed-turn log scanning, publishes xAI list-price estimates, and keeps OpenCodex xAI history token-only without request-time credential provenance.

Merge readiness

⛔ Blocked until stronger real behavior proof is added - 5 items remain

Keep this PR open: the implementation appears to address the prior code findings, but an owner must approve showing subscription-adjacent xAI list-price estimates and the submitted live proof predates the final scanner head.

Priority: P2
Reviewed head: e6839185aa6fcd6173c4498209113a6ea9dc40ce
Owner decision: Required. See Decision needed.

Review scores

Verification

Live Verification

Command: swift run codexbar --help

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

Assertions:

• FAIL expect_output: Usage:

How this fits together

CodexBar converts provider snapshots and local logs into normalized token-and-cost snapshots for its Usage & Spend dashboard. This change alters the Grok local-log input, price lookup, and fallback publication path before the dashboard renders the provider row.

flowchart LR
A[Grok CLI session logs] --> B[Bounded completed-turn scanner]
C[xAI price catalog] --> D[Price resolution]
B --> D
D --> E[Usage and Spend snapshot]
E --> F[Grok provider row]
G[OpenCodex xAI records] --> H[Token-only routing]
H --> E

Decision needed

Why: The branch adds a user-visible interpretation of local provider data rather than merely correcting an internal parser, and VISION.md reserves new provider-data behavior for sign-off.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Earlier real-session output and dashboard screenshots are useful, but the PR states they predate the final empty-cache and bounded-scanner head; add a fresh redacted exact-head run before merge, then update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review.
• Resolve merge risk (P1) - Existing users will see materially different Grok token totals and a new dollar figure; list price is not subscription billing and requires explicit owner approval.
• Resolve merge risk (P1) - The available live output and screenshots predate the final bounded-scanner and empty-cache publication head, so they do not prove exact-head behavior in a real local Grok setup.
• Complete next step (P2) - The remaining blockers are owner product direction and contributor-supplied exact-head real behavior proof, not a narrow repair suitable for an automated fix branch.

Both automated findings are addressed, plus the review's other checklist items. The inline comments were left against 09cf7edb0, which no longer exists — the branch has since been rebased onto 27c7f334e and the head is now 03e5a25dc, so I'm summarising here rather than replying in a stale diff.

P1 — Preserve the Grok fallback on repeated probe failures

Fixed in 923193ec0, Sources/CodexBar/UsageStore+Refresh.swift. The guard had been hoisted into the if provider == .grok, publication == nil condition, so a Grok failure with a publication fell through to the generic else if tokenCostRequiresProviderSnapshot { clearTokenSnapshot } branch. Grok now owns its branch outright and can never reach the clear:

if provider == .grok {
    if self.tokenSnapshotPublicationForCurrentProviderConfig(for: provider) == nil {
        Task { @MainActor [weak self] in
            await self?.scanAndPublishGrokLocalTokenSnapshot(...)
        }
    }
} else if Self.tokenCostRequiresProviderSnapshot(provider) {
    self.clearTokenSnapshot(for: provider)
}

Regression coverage is in missing remote snapshot scans and publishes local tokens then clears empty data. Per the review's request it now drives two consecutive failing refreshes (03e5a25dc) rather than one — which matters here, because the first failure is what publishes through the fallback scan and only the second arrives with a publication in place, i.e. the failure that used to wipe the row. Both iterations assert the row still reads 77 tokens and that no redundant rescan ran.

P2 — Refresh pricing before scanning Grok sessions

Correct, and thank you — this was a genuine gap and not one the local tests would have surfaced. refreshPricingIfAllowed is gated to Codex and Claude, and Grok never reaches it at all because its snapshot comes from the provider probe rather than CostUsageFetcher.loadTokenSnapshot. On a machine with Codex or Claude also enabled the shared cache is already populated, so the failure is invisible there; enable only Grok and the catalog never appears and the Cost row shows tokens with no money, permanently.

Fixed in 744677e68. The Grok scan paths now request ModelsDevPricingPipeline.refreshIfNeeded through a summarizeRequestingPricingRefresh wrapper, called from all four scan sites (GrokStatusProbe, both branches in GrokProviderDescriptor, and UsageStore.scanAndPublishGrokLocalTokenSnapshot). It is detached rather than awaited, matching how the Codex and Claude paths already treat it — pricing availability must not delay or fail a local scan — and it is safe to call repeatedly, since it returns immediately unless the cache is stale and serialises through its own coordinator. summarize itself stays synchronous and side-effect free.

Note the inline comment still points at GrokLocalSessionScanner.swift:662; that line is the unchanged pricing lookup, and the fix is upstream of it in the new wrapper, so the anchor looks live even though it is addressed.

Coverage: absent models dev cache requests a background refresh, stale models dev cache requests a background refresh, and fresh models dev cache skips the background refresh. All three assert whether a refresh was requested through an injected transport — no test touches the network.

Real-session evidence

CODEXBAR_LIVE_GROK_CATALOG_PROOF=1 swift test --filter GrokXAISpendCatalogTests, against real local Grok CLI sessions, through the shipped code path:

catalog_source=grok
today_tokens=5043749
last_30_days_tokens=52696354
today_cost_usd=3.3471699999999993
window_cost_usd=49.353424
cost_provenance=listPriceEstimate
history_days=365
priced_days=4
token_days=4
daily_buckets=4
available_sources=grok

The same corpus on main reports 653K tokens and no cost. history_days=365 shows the requested window is honoured (it was pinned to 30). priced_days == token_days shows no day was silently left unpriced. The gated proof was extended in e3cd3b9ce to print cost, provenance and priced-day coverage, since tokens alone cannot evidence the half of this change that is about money.

Those figures were cross-checked against an independent reimplementation of the pricing formula over the same logs; the two agree to the cent.

Merge risk / branch state

Rebased onto current main (27c7f334e); the branch reports clean. Full suite on the head: 77/77 groups, 922 selections, 0 failures. swiftformat --lint and swiftlint --strict clean. Upstream CI green on the previous head including all three Linux builds.

One thing deliberately left undone: no CHANGELOG.md entry. 0.54.1 was finalized and there is no open Unreleased section, so I did not invent a version heading — happy to add one wherever you prefer.

Both new findings addressed at 44d79a95a.

P1 — Do not map every xAI log record to the Grok subscription

Agreed, and taken as specified rather than argued down. Routing on the prefix alone is right for the case that motivated this — traffic authenticated with the user's Grok account, which is what makes it consume SuperGrok quota — but it silently folds an API-key user's pay-as-you-go xAI spend into the subscription row. CodexBar already models the developer platform as its own xai provider precisely to keep those apart, so the old behaviour crossed a boundary the app deliberately maintains.

The usage log carries no per-record credential evidence; I checked every field emitted for xai rows (requestId, timestamp, provider, model, requestedModel, resolvedModel, usage, usageStatus, status, routeDecision, …) and there is nothing about auth, account or key. The signal that does exist is ~/.opencodex/config.json, which records authMode per provider.

So attribution now requires positive OAuth evidence:

• xai routes to .subscription(.grok) only when its configured authMode is OAuth. Anything else returns .tokenOnly — the spend is real, it just belongs to no tracked subscription — rather than .unknown, which would read as "unrecognised provider".
• Fail closed. A missing or malformed config, a providers block without xai, or an entry without authMode all count as no evidence and keep the records off the Grok row.
• OpenCodexRouteDispatcher stays a pure function. The set of OAuth-backed provider ids is threaded in from the caller (OpenCodexUsageFanOut → SpendDashboardSource), so the routing site never touches the filesystem and every existing caller and test that does not care about auth keeps working.
• The gate applies only to xai. openai, kimi-coding, deepseek and opencode-go are untouched — changing them would be an unreviewed behaviour change for other providers — and a test pins that they ignore xAI auth state entirely.

Coverage: xai OAuth config routes to Grok, xai non OAuth config stays token only (parameterised over several non-OAuth values), xai routing fails closed without readable complete OAuth config, non xai subscription routes ignore xai auth state, plus fan-out cases proving the same entries land on the Grok row under an OAuth config and are absent under an API-key one. No test reads the developer's real ~/.opencodex; the home directory is injected.

docs/grok.md no longer claims this path cannot distinguish OAuth from API-key traffic, because it now can.

P2 — Republish the Grok snapshot after a missing catalog refreshes

I looked at this closely and am deliberately not adding a republish path. Reasoning, so you can overrule it if you disagree:

The refresh is fire-and-forget, so the scan that requests it returns whatever the cache currently holds — that part is accurate. But the parse cache stores parsed turns, not prices, so aggregation and pricing re-run on every summarize. The next Grok scan therefore prices against the refreshed catalog with no extra machinery, bounding the unpriced window to a single refresh cycle. That is the same behaviour Codex and Claude already have: refreshPricingIfAllowed dispatches into Task.detached and their current scan does not wait for it either.

The alternative — plumbing a completion signal back across the actor boundary into the @MainActor publication path — buys one refresh cycle of latency on first run, at the cost of a new cross-actor completion path in code that publishes user-visible spend. That trade looked disproportionate, and inconsistent with how the two established providers behave. I have recorded the reasoning as a comment at the call site rather than leaving it implicit, so the next reader does not have to re-derive it.

Happy to build it if you would rather have it.

Evidence

The attribution itself only becomes visible in the app: SpendDashboardSource.mergingOpenCodexInputs is what merges the fan-out into provider rows, and the CLI's cost command reports OpenCodex as its own source rather than routing it, so terminal output cannot show this path. The figures below are read off the freshly packaged build running against real local data, on a machine whose ~/.opencodex/config.json has "xai": { "authMode": "oauth" }; screenshots of both panes follow.

The two halves stay distinguishable in the UI, which makes the attribution legible rather than something you have to take on trust: the CLI goes through the responses API so its SKU is grok-4.6-build, while OpenCodex's records resolve to the bare grok-4.6 / grok-4.5 / grok-4.3. Both sit under the Grok provider.

Independently recomputing the same corpus agrees to the cent on both halves: 54,121,501 tokens / $50.52 for the CLI logs, and $166.25 across 1,520 OpenCodex xai records. The CLI half is reproducible by anyone on their own machine through the gated proof test (CODEXBAR_LIVE_GROK_CATALOG_PROOF=1), whose output is in the PR body.

The negative direction — API-key traffic staying off the Grok row — is covered by tests rather than a screenshot, since demonstrating it live would mean rewriting the machine's OpenCodex config.

State

Full suite on 44d79a95a: 77/77 groups, 922 selections, 0 failures. swiftformat --lint and swiftlint --strict clean. Rebased on 27c7f334e.

Addressed both current findings in 211e1977d and resolved the two review threads.

• P1 / historical xAI attribution: removed current-config-based xAI → Grok routing. usage.jsonl has no request-time credential provenance, so xAI records now remain token-only until the producer can persist that evidence. Removed the config reader/plumbing and added dispatcher/fan-out regressions.
• P2 / first pricing publication: when no models.dev artifact exists, the first Grok scan now awaits the initial best-effort refresh attempt before summarizing. A successful refresh prices the first returned snapshot; stale catalogs still price immediately and refresh in the background. Added a regression that writes the catalog during refresh and asserts the first summary is priced.
• Updated the PR title/body and docs/grok.md so they no longer claim OpenCodex xAI traffic is merged into the Grok subscription row.

Validation on the exact pushed head:

• focused Grok/OpenCodex suites: 32 tests passed
• make check: passed
• make test: 922 selections, 77/77 groups, 0 failed groups, 0 retries
• branch is based on current main (27c7f334e) and the merge-tree is clean

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Addressed both findings from the 211e1977d review at exact head 7dac4df01.

• P2 / bounded JSONL scan: replaced whole-file Data(contentsOf:) ingestion with the shared chunked scanner. Production limits are 64 MiB/file, 1 MiB/record, 20,000 turns/file, 256 recent sessions, 256 MiB and 100,000 turns per scan, plus a process LRU capped at 64 files / 50,000 turns. Cancellation is checked between chunks; cancelled/I/O-error decodes are not cached; any dropped history propagates historyCoverageIsEstablished = false.
• P3 / documentation: replaced the stale signals.json/30-day description with completed-turn updates.jsonl, the requested window up to 365 days, the non-billed list-price provenance, metadata-only signals.json, and the exact bounds above.
• Added regressions for bounded tail retention/incomplete coverage, global newest-session/turn budgets, and process-wide cache eviction.

Exact-head validation:

• focused Grok/OpenCodex suites: 35 tests passed
• make check: passed, SwiftFormat 0/1984 and SwiftLint 0 violations
• make test: 922 selections, 77/77 groups, 0 failed groups, 0 retries
• branch is current with main (27c7f334e) and git diff --check is clean

I did not rerun the gated real-account proof because repository policy forbids unrequested live provider/credential probes. The PR body now labels the earlier live output as pre-final-head evidence and leaves a fresh redacted empty-cache run as an explicit maintainer/requested follow-up. The product-policy question about showing clearly labeled public list-price estimates also remains for owner sign-off.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32633583953
• Updated: 2026-08-23T10:22:59.783Z

Pushed e6839185a to fix the Linux-only compile failure reported by CI. Darwin exposes the labeled autoreleasepool(invoking:) form while Linux rejects that label, so decoding now goes through a small conditional helper: scoped autorelease pool on Darwin, direct decode elsewhere. No scanner behavior or bounds changed.

Final exact-head validation:

• focused OpenCodex/Grok suites: 35 tests passed
• make check: passed (SwiftFormat 0/1984, SwiftLint 0 violations)
• make test: 922 selections, 77/77 groups, 0 failed, 0 retries (784.1s)

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Final exact-head status for e6839185aa6fcd6173c4498209113a6ea9dc40ce:

• GitHub CI is fully green: lint, path gates, Linux x64, Linux ARM64, Linux musl, both macOS test shards, aggregate gate, and GitGuardian.
• ClawSweeper reviewed this exact SHA and reports Findings: None.
• Both inline review threads are resolved.
• The branch is current with upstream/main, has a clean merge-tree, and GitHub reports MERGEABLE / CLEAN.

The only remaining gates are intentionally human: a fresh redacted exact-head live Grok proof (requires explicit authorization under repository policy) and owner approval of the clearly labeled non-billed xAI list-price signal.