Skip to content

Support read-only Claude account adapters - #3658

Closed
benedictfrancis wants to merge 1 commit into
steipete:mainfrom
benedictfrancis:feature/read-only-claude-swap-adapters
Closed

benedictfrancis wants to merge 1 commit into
steipete:mainfrom
benedictfrancis:feature/read-only-claude-swap-adapters

Conversation

@benedictfrancis

Copy link
Copy Markdown
Contributor

Summary

  • Add an optional supportsAccountSwitching capability to Claude account-list adapters.
  • Preserve existing schema-v1 behaviour by defaulting the capability to true.
  • Suppress account activation actions when an adapter declares itself read-only.

Verification

  • swift test --filter ClaudeSwapListParserTests
  • swift test --filter ClaudeSwapAccountProjectionTests
  • make check

@clawsweeper

clawsweeper Bot commented Sep 15, 2026

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9dfcf784cf

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

}
let supportsAccountSwitching: Bool
if let rawSupportsAccountSwitching = object["supportsAccountSwitching"] {
guard let value = rawSupportsAccountSwitching as? Bool else {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject numeric switching-capability values

JSONSerialization represents both JSON numbers and booleans as NSNumber, and Swift's conditional bridge lets numeric 0 and 1 pass as? Bool. Consequently, a malformed payload such as "supportsAccountSwitching": 1 is accepted as true, making account snapshots actionable and allowing the switching flow instead of rejecting the malformed capability. Verify that the value's Core Foundation type is CFBooleanGetTypeID(), as the numeric parser below already does.

Useful? React with 👍 / 👎.

@clawsweeper clawsweeper Bot added P2 Normal priority bug or improvement with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Sep 15, 2026
@clawsweeper

clawsweeper Bot commented Sep 15, 2026

Copy link
Copy Markdown

Codex review: needs real behavior proof before merge. Reviewed September 15, 2026, 7:40 AM ET / 11:40 UTC.

ClawSweeper review

What this changes

The PR adds an optional capability to Claude account adapters that disables account activation while preserving usage display and existing adapters’ default switching behavior.

Merge readiness

Blocked before merge - 3 items remain

This remains a useful, bounded contribution absent from current main. The previously reported Boolean-validation defect remains unresolved, and the supplied verification does not demonstrate the changed runtime behavior.

Priority: P2
Reviewed head: 9dfcf784cfa41629320ca5bd0945b89a33a57cce

Review scores

Measure Result What it means
Overall readiness 🦪 silver shellfish (2/6) The patch is focused and uses the existing architecture, but an unresolved parser defect and test-only proof prevent merge readiness.
Proof confidence 🦪 silver shellfish (2/6) Needs real behavior proof before merge: Needs real behavior proof before merge: the captured body provides tests and lint only, without exercising the adapter-to-menu path after the change. Provide redacted native screenshots or a recording showing usage remains visible and activation disappears for a read-only adapter, plus terminal output or logs demonstrating legacy switching remains available when the field is omitted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🦐 gold shrimp (3/6) 1 actionable review finding remain.

Verification

Check Result Evidence
Real behavior Needs proof Needs real behavior proof before merge: Needs real behavior proof before merge: the captured body provides tests and lint only, without exercising the adapter-to-menu path after the change. Provide redacted native screenshots or a recording showing usage remains visible and activation disappears for a read-only adapter, plus terminal output or logs demonstrating legacy switching remains available when the field is omitted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 8 items Introduced patch verified: The pinned merge-base-to-head diff changes five files: two production files, two test files, and one design document. The checkout matches the supplied original head.
Capability parser accepts numeric Boolean bridges: The new parser uses as? Bool without checking CFBoolean type identity. JSON numbers 0 and 1 can therefore pass this validation. The same file already distinguishes JSON numbers from booleans with CFGetTypeID in finiteDouble.
Existing review finding remains applicable: The supplied review comment identifies the same numeric-Boolean defect at #3658 (comment). It reviewed the same head inspected here; no subsequent repair is present.
Findings 1 actionable finding [P2] Reject numeric switching-capability values
Security None None.

How this fits together

CodexBar reads account and usage data from a user-configured Claude adapter executable. It converts that data into account cards whose activation controls can invoke an explicit account-switch command.

flowchart TD
  A[Configured Claude adapter] --> B[Account list JSON]
  B --> C[Validate switching capability]
  C --> D[Account snapshots]
  D --> E[Usage cards]
  E --> F{Activation allowed?}
  F -->|No| G[Inspect usage only]
  F -->|Yes and clicked| H[Explicit account switch]
Loading

Before merge

  • Add real behavior proof - Needs real behavior proof before merge: Needs real behavior proof before merge: the captured body provides tests and lint only, without exercising the adapter-to-menu path after the change. Provide redacted native screenshots or a recording showing usage remains visible and activation disappears for a read-only adapter, plus terminal output or logs demonstrating legacy switching remains available when the field is omitted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
  • Reject numeric switching-capability values (P2) - JSONSerialization bridges JSON numbers and booleans through NSNumber, so numeric 0 and 1 can pass as? Bool. An otherwise valid payload with supportsAccountSwitching: 1 is therefore accepted and leaves eligible accounts actionable instead of rejecting the malformed capability. Check CFGetTypeID against CFBooleanGetTypeID() before decoding, and cover both numeric values alongside genuine booleans and an omitted field. This preserves the still-unfixed finding already posted on this head.
  • Complete next step (P2) - Fix strict Boolean validation and supply redacted after-fix adapter evidence covering read-only cards and unchanged legacy switching.

Findings

  • [P2] Reject numeric switching-capability values — Sources/CodexBarCore/Providers/Claude/ClaudeSwap/ClaudeSwapAccountList.swift:194-198
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Production and test delta Production +29/-4; tests +64/-0; docs +2/-0 Production growth is narrowly justified by capability parsing and projection, with focused supplemental tests.

Technical review

Best possible solution:

Keep the additive capability on the existing adapter path, validate genuine JSON booleans strictly, and preserve legacy switching when the field is omitted.

Do we have a high-confidence way to reproduce the issue?

Yes, from source on the PR branch: use numeric 1 for supportsAccountSwitching in an otherwise valid list containing an inactive eligible account; the Boolean bridge accepts it and leaves activation enabled. This was not executed, and current main lacks the new field.

Is this the best way to solve the issue?

Yes in architecture: reusing the existing canActivate path is narrow and preserves legacy defaults. The parser must reject numeric substitutes before the implementation is correct.

Full review comments:

  • [P2] Reject numeric switching-capability values — Sources/CodexBarCore/Providers/Claude/ClaudeSwap/ClaudeSwapAccountList.swift:194-198
    JSONSerialization bridges JSON numbers and booleans through NSNumber, so numeric 0 and 1 can pass as? Bool. An otherwise valid payload with supportsAccountSwitching: 1 is therefore accepted and leaves eligible accounts actionable instead of rejecting the malformed capability. Check CFGetTypeID against CFBooleanGetTypeID() before decoding, and cover both numeric values alongside genuine booleans and an omitted field. This preserves the still-unfixed finding already posted on this head.
    Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.95

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9db44805dc1e.

Labels

Label changes:

  • add P2: This is a bounded adapter improvement with one concrete parser defect and no demonstrated urgent user regression.
  • add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Needs real behavior proof before merge: the captured body provides tests and lint only, without exercising the adapter-to-menu path after the change. Provide redacted native screenshots or a recording showing usage remains visible and activation disappears for a read-only adapter, plus terminal output or logs demonstrating legacy switching remains available when the field is omitted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

  • P2: This is a bounded adapter improvement with one concrete parser defect and no demonstrated urgent user regression.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Needs real behavior proof before merge: the captured body provides tests and lint only, without exercising the adapter-to-menu path after the change. Provide redacted native screenshots or a recording showing usage remains visible and activation disappears for a read-only adapter, plus terminal output or logs demonstrating legacy switching remains available when the field is omitted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

Likely related people:

  • Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • Sina: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Require genuine JSON booleans and add regression cases for numeric 0 and 1, explicit true/false, and omission; run the focused suites, make test, and make check.
  • Add after-fix native adapter evidence for read-only behavior and legacy compatibility with existing settings; redact account details, credentials, IP addresses, and private endpoints. Updating the PR body should trigger review automatically; otherwise ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

steipete added a commit that referenced this pull request Sep 22, 2026
Respect supportsAccountSwitching=false in schema-v1 account lists while
preserving usage, account details, and active markers. Keep the existing
switching default when the field is absent and reject nonboolean values.

Cover parsing, projection, and suppression of credential commands. Reuse
quota parsing and remove single-use projection wrappers to keep the
production diff at zero net lines.

Adopts #3658.

Co-authored-by: benedictfrancis <benedict@techniciti.eu>
(cherry picked from commit 86c1bd0)
steipete added a commit that referenced this pull request Sep 22, 2026
Respect supportsAccountSwitching=false in schema-v1 account lists while
preserving usage, account details, and active markers. Keep the existing
switching default when the field is absent and reject nonboolean values.

Cover parsing, projection, and suppression of credential commands. Reuse
quota parsing and remove single-use projection wrappers to keep the
production diff at zero net lines.

Adopts #3658.

Co-authored-by: benedictfrancis <benedict@techniciti.eu>
(cherry picked from commit 86c1bd0)
@steipete

Copy link
Copy Markdown
Owner

Thanks @benedictfrancis. Your implementation is adopted in #3846 (86c1bd0b795e), preserving the schema-v1 default and strictly rejecting nonboolean capability values. Read-only lists retain usage and account details while suppressing switching and credential repair. The regressions failed before the fix and passed afterward; synthetic coverage confirms no credential command starts. All 201 selected local tests, make check, independent review, and CI passed. Contributor credit is preserved. #3846 landed via #3867; closing as superseded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

P2 Normal priority bug or improvement with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants