train: land 4088 4090 4095

[steipete]

Merge train: one CI run for 3 green lane PRs, each kept as its own commit (rebase merge).

• fix(codex): retry auth reads and reset quota baselines on plan changes #4088
• fix(refresh): detect nested ChatGPT Codex app-server #4090
• fix(widgets): isolate last-good retention by provider #4095

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f317133e90

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Retry credential publication races during availability checks

When auth.json is briefly missing or partially written, the fetch pipeline calls isAvailable before it ever calls fetch. This passes retryStale: false, so the first read failure returns false and skips the OAuth strategy entirely; the retry-enabled load in fetch is never reached (leaving explicit OAuth with no available strategy and auto mode to fall back). This also makes the newly added availability-race test fail, since it expects the second read to observe the completed credential file.

Useful? React with 👍 / 👎.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 28, 2026, 5:35 AM ET / 09:35 UTC.

ClawSweeper review

What this changes

Combines three commits that retry Codex credential reads and reset plan baselines, recognize ChatGPT’s nested Codex app-server for adaptive refresh, and retain eligible widget readings per provider.

Merge readiness

✅ Ready for maintainer review

Keep open: current main lacks the addressed behavior, and this owner-authored PR is not eligible for cleanup closure. The existing availability-race review comment misreads the retry helper; read and decode failures still receive bounded retries.

Priority: P2
Reviewed head: f317133e90bc523121d4189e17531723e182fc79

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch has focused coverage and no confirmed blocking defect, while direct after-fix runtime evidence covers only the synthetic widget display.
Proof confidence	🦐 gold shrimp (3/6)	Not applicable: This owner-authored train is exempt from the external-contributor proof gate. The linked synthetic before/after images show the changed snapshot writer’s output in an offscreen widget view; the credential and process lanes have focused fixtures and reported baseline or installed-binary checks, but no after-fix installed-app observation. No stored-data format changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored train is exempt from the external-contributor proof gate. The linked synthetic before/after images show the changed snapshot writer’s output in an offscreen widget view; the credential and process lanes have focused fixtures and reported baseline or installed-binary checks, but no after-fix installed-app observation. No stored-data format changes.
Evidence reviewed	12 items	Introduced scope: The pinned main-to-head diff contains three distinct fixes across credential fetching, session scanning, and widget snapshot publication; the verified test merge has the pinned main and PR head as its parents. Availability retry control flow: Availability calls the shared loader with retryStale false, but thrown credential read or decode errors enter its catch block and retry up to two times. The flag only stops rereads after a successful load of stale credentials, so the existing review comment’s stated failure mechanism does not follow from this code. Fetch ordering: The pipeline calls isAvailable before fetch, making the availability path relevant to the reported race.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar reads Codex credentials and local agent activity to produce usage readings and choose refresh timing. Its app store writes provider snapshots that widgets display.

flowchart LR
  A[Codex credentials] --> B[Usage fetch]
  C[Running agent processes] --> D[Trusted session scan]
  D --> E[Refresh timing]
  E --> B
  B --> F[Provider readings]
  F --> G[Widget snapshot]
  G --> H[Widget display]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Combined scope	3 commits, 24 files	Three separate fixes share this train’s merge validation.
Code and test delta	production −16 net lines, tests +696 net lines	The combined patch adds substantial focused regression coverage without growing production code.

Technical review

Best possible solution:

Keep the existing fetch pipeline, consented session scanner, and widget snapshot writer as the ownership points, while preserving credential and account isolation.

Do we have a high-confidence way to reproduce the issue?

Yes: isolated credential-reader, nested-process, and widget-refresh fixtures give concrete paths through the reported failures. This read-only review did not execute them.

Is this the best way to solve the issue?

Yes: the changes use the existing fetch, scanner, and snapshot owners, with bounded credential retries and provider-specific widget retention.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 03f4b6888193.

Labels

Label changes:

• add P2: The train addresses limited-scope Codex usage, adaptive-refresh, and widget regressions.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. This owner-authored train is exempt from the external-contributor proof gate. The linked synthetic before/after images show the changed snapshot writer’s output in an offscreen widget view; the credential and process lanes have focused fixtures and reported baseline or installed-binary checks, but no after-fix installed-app observation. No stored-data format changes.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored train is exempt from the external-contributor proof gate. The linked synthetic before/after images show the changed snapshot writer’s output in an offscreen widget view; the credential and process lanes have focused fixtures and reported baseline or installed-binary checks, but no after-fix installed-app observation. No stored-data format changes.

Label justifications:

• P2: The train addresses limited-scope Codex usage, adaptive-refresh, and widget regressions.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored train is exempt from the external-contributor proof gate. The linked synthetic before/after images show the changed snapshot writer’s output in an offscreen widget view; the credential and process lanes have focused fixtures and reported baseline or installed-binary checks, but no after-fix installed-app observation. No stored-data format changes.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. This owner-authored train is exempt from the external-contributor proof gate. The linked synthetic before/after images show the changed snapshot writer’s output in an offscreen widget view; the credential and process lanes have focused fixtures and reported baseline or installed-binary checks, but no after-fix installed-app observation. No stored-data format changes.

Evidence

What I checked:

• Introduced scope: The pinned main-to-head diff contains three distinct fixes across credential fetching, session scanning, and widget snapshot publication; the verified test merge has the pinned main and PR head as its parents. (f317133e90bc)
• Availability retry control flow: Availability calls the shared loader with retryStale false, but thrown credential read or decode errors enter its catch block and retry up to two times. The flag only stops rereads after a successful load of stale credentials, so the existing review comment’s stated failure mechanism does not follow from this code. (Sources/CodexBarCore/Providers/Codex/CodexProviderDescriptor.swift:407, f317133e90bc)
• Fetch ordering: The pipeline calls isAvailable before fetch, making the availability path relevant to the reported race. (Sources/CodexBarCore/Providers/ProviderFetchPlan.swift:410, f317133e90bc)
• Credential regression fixture: The new availability fixture supplies a partial first read and complete second read, then asserts availability and exactly two reads. It was inspected but not executed in this read-only review. (Tests/CodexBarTests/CodexOAuthExpiryPipelineTests.swift:45, f317133e90bc)
• Process trust boundary: The new scanner path checks the kernel-reported executable path, rejects symlink redirects, validates the running process’s OpenAI signature, and assesses the outer ChatGPT bundle before accepting the app-server signal. (Sources/CodexBarCore/LocalAgentSessionScanner.swift:35, f317133e90bc)
• Scan authorization and effect: Local monitoring remains gated by settings before the scanner runs; the trusted process signal then controls whether unmatched Codex rollout metadata is read. (Sources/CodexBarCore/LocalAgentSessionScanner.swift:180, f317133e90bc)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Tom Vaucourt: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Yuxin Qiao: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• A redacted post-fix credential-publication trace through the selected Codex workspace would strengthen the OAuth lane’s runtime evidence.
• An installed signed ChatGPT app-server scan showing the adaptive cadence would strengthen the native scanner lane’s runtime evidence.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.