Add opt-in multi-account dashboard snapshots

[roboclaw-bot]

Summary

• Add explicit --all-accounts support to codexbar serve dashboard snapshots and codexbar dashboard, reusing existing Codex profile/managed-account discovery and configured token-account fetching.
• Group local accounts into the existing providers[].accounts[] contract. Keep provider-level fields and cache metadata attached to the selected account, even when it is not first in discovery order.
• Use opaque, stable public account IDs, redact account labels and errors, isolate collection modes in cache keys, and retain healthy account results when a sibling fails.
• Preserve defaults, /usage behavior, and the existing claude-swap integration. No remote client, Sync settings, Keychain changes, or new dependencies.

Related: extracts the server-side scope discussed in #3791; that PR is unchanged.

Verification

Current source: 123bb7b27d3a998ffeafca0e4dcc89f76e963f36. Runtime captures below use 0601278c0; subsequent revisions only add explanatory comments and update renderer tests, without changing production behavior.

• Swift 6.3.3 compilation and all 12 DashboardMultiAccountTests tests, including parameterized cases: passed. Collector-level coverage now drives a real shared provider deadline, retains completed account data for both coalesced waiters, isolates changed configurations, and verifies unchanged default timeout behavior.
• Full Linux make test: passed all 8 groups covering 87 discovered selections, with no failures, retries, or timeouts.
• Complete ./Scripts/lint.sh lint-linux: passed, including portable checks, JavaScript/TypeScript checks, and strict SwiftLint on 2,539 configured files. The new Linux test file was also linted explicitly.
• SwiftFormat, git diff --check, documentation links, and CLI smoke checks: passed.
• Complete macOS verification passed on this exact head using Xcode 26.6 / Swift 6.3.3: make check, focused account/deadline/rendering/architecture regressions, both full make test shards, and QuickJS/JavaScriptCore plugin-engine parity. The two full shards passed all 87 and 86 groups, covering all 1,308 discovered selections, with zero failures, retries, or timeouts. Successful independent macOS run.
• Earlier native runs caught required architecture annotations and two UI tests pinning an internal JavaScript function signature. The annotations and tests were corrected; the final complete run above verifies the fixes. No failed, cancelled, or skipped lane is substituted for a passing required test.

Both review findings are addressed: completed siblings survive a slow account's deadline, and the selected Codex credit balance stays visible on its own card (not on sibling or claude-swap cards).

Runtime and visual proof

Curated proof bundle and command details

The actual compiled CLI and authenticated HTTP server read two isolated Codex profile homes and fetched usage from a loopback-only mock provider through the existing chatgpt_base_url setting. These are executable integration results using synthetic credentials, not live-provider validation. No real accounts, browser cookies, or Keychain access were used.

• Both transports discovered two accounts, selected the non-first account, returned 20%/65% usage and 42.5 selected-account credits, and redacted email identities.
• With the second account delayed beyond a two-second budget, both transports retained the healthy first account and returned an account-local timeout for the second. The bundle includes the actual redacted CLI and server JSON outputs.
• Production dashboard HTML, 1200×800/light: credits appear exactly once on the active account. A 390px/dark check also passed, including a zero balance, without horizontal overflow or card overlap.

Before

After

Upstream GitHub Actions still requires maintainer approval for the fork. Independent fork verification does not approve or replace that gate. The PR remains ready for review; it is not merged.

Worked on by

• @VACInc

Work sessions

• Original discussion with @VACInc
• Implementation and verification

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 21, 2026, 11:57 AM ET / 15:57 UTC (Revision 5).

ClawSweeper review

What this changes

Adds an opt-in --all-accounts flag to CLI and HTTP dashboard snapshots, grouping local accounts while preserving selected-account fields and showing account-specific results.

Merge readiness

⛔ Blocked before merge - 2 items remain

This remains a useful, distinct contribution: current main lacks the requested dashboard expansion, both earlier findings are addressed, and the supplied runtime evidence supports the implementation. Repository policy also excludes automatic closure.

Priority: P2
Reviewed head: 123bb7b27d3a998ffeafca0e4dcc89f76e963f36
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused implementation with convincing production-path evidence, resolved prior findings, and successful independent macOS validation.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): The compiled CLI and authenticated HTTP server exercised account discovery, selected-account projection, and injected timeout recovery through the real collection path; inspected JSON and production-renderer screenshots show the expected results. Later changes are comments and tests only.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The compiled CLI and authenticated HTTP server exercised account discovery, selected-account projection, and injected timeout recovery through the real collection path; inspected JSON and production-renderer screenshots show the expected results. Later changes are comments and tests only.
Evidence reviewed	11 items	Repository policy and review scope: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-note files were found under the reviewed paths. Applied account separation, concurrency, focused validation, and Keychain safety guidance; no builds, tests, or provider probes were executed during this read-only review. Pinned introduced changes: Reviewed the merge-base-to-head changes and original collection paths. Account discovery and credential-scoped fetching reuse existing implementations; new dashboard grouping is explicitly enabled. The supplied test merge is stale and was not used to claim removal of current-main behavior. Still absent from current main and latest release: The fetched main command has no all-accounts option and explicitly sets includeAllCodexAccounts to false. The same selected-account setting was independently checked in v0.63.0; no fixing merged PR is established.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s dashboard collects usage from locally configured providers and presents it as JSON or browser cards. The shared collector feeds both the one-shot CLI command and the authenticated HTTP endpoint.

flowchart TD
  A[Local account configuration] --> B[Account scope selection]
  C[Dashboard command or authenticated request] --> B
  B --> D[Provider usage collection]
  D --> E[Completed results and account errors]
  E --> F[Selected account and grouped snapshot]
  F --> G[CLI JSON or browser cards]

Loading

Decision needed

Question	Recommendation
Should --all-accounts become a supported dashboard and serve option independently of the broader remote-client proposal?	Accept the focused dashboard option: Support local account expansion through the existing snapshot contract while retaining current defaults.

Why: The patch adds supported CLI surface, and the supplied discussion contains no maintainer acceptance of that product scope.

Before merge

• Complete next step (P2) - Confirm whether to support the opt-in dashboard account expansion independently of the remote-client proposal.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +312/-64 lines; tests +445/-8 lines	Production growth implements account projection and partial-result handling, with focused coverage for both.

Technical review

Best possible solution:

Adopt the shared, opt-in dashboard projection while preserving selected-account defaults and keeping remote-client and credential-recovery work separate.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a new capability; current-main source confirms selected-account dashboard collection, and supplied integration captures demonstrate the proposed expansion.

Is this the best way to solve the issue?

Yes: reusing existing account discovery and the shared snapshot producer is a focused solution, with unchanged defaults and no separate credential implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 94ca725b4c37.

Labels

Label justifications:

• P2: This is a bounded, opt-in dashboard improvement without an established urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The compiled CLI and authenticated HTTP server exercised account discovery, selected-account projection, and injected timeout recovery through the real collection path; inspected JSON and production-renderer screenshots show the expected results. Later changes are comments and tests only.
• proof: sufficient: Contributor real behavior proof is sufficient. The compiled CLI and authenticated HTTP server exercised account discovery, selected-account projection, and injected timeout recovery through the real collection path; inspected JSON and production-renderer screenshots show the expected results. Later changes are comments and tests only.

Evidence

What I checked:

• Repository policy and review scope: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-note files were found under the reviewed paths. Applied account separation, concurrency, focused validation, and Keychain safety guidance; no builds, tests, or provider probes were executed during this read-only review. (AGENTS.md:1, 123bb7b27d3a)
• Pinned introduced changes: Reviewed the merge-base-to-head changes and original collection paths. Account discovery and credential-scoped fetching reuse existing implementations; new dashboard grouping is explicitly enabled. The supplied test merge is stale and was not used to claim removal of current-main behavior. (Sources/CodexBarCLI/CLIUsageCommand.swift:266, 123bb7b27d3a)
• Still absent from current main and latest release: The fetched main command has no all-accounts option and explicitly sets includeAllCodexAccounts to false. The same selected-account setting was independently checked in v0.63.0; no fixing merged PR is established. (Sources/CodexBarCLI/CLIDashboardCommand.swift:12, 94ca725b4c37)
• Release cross-check: The latest supplied release still defines DashboardOptions without the new flag and collects only the selected Codex account. (Sources/CodexBarCLI/CLIDashboardCommand.swift:231, f3e718c897d5)
• Previous findings resolved: The collector publishes completed siblings plus timeout placeholders before subsequent fetches; the coordinator returns that generation’s partial value to waiting callers. Renderer coverage checks that selected Codex credits appear once, including zero balances. These address both findings retained in earlier review cycles. (Sources/CodexBarCLI/DashboardAccountCollector.swift:14, 123bb7b27d3a)
• Production-path runtime and visual evidence: Inspected the proof README, all four captured CLI/server JSON outputs, and both downloaded screenshots. The compiled CLI and authenticated server exercised real collection against a loopback fixture using synthetic credentials: both accounts appeared, the second owned 65% usage and 42.5 credits, and delayed-second-account runs retained the first account’s 20% usage. The after screenshot shows credits only on the active card. This is production-path integration evidence, not live-provider verification. (proof/pr-3832/README.md:1, 0a7133169c03)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• jethac: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-09-21T13:36:39.909Z sha 85f0909 :: needs real behavior proof before merge. :: [P2] Preserve completed accounts when a sibling exceeds the deadline | [P2] Keep Codex credit balances visible in expanded dashboard groups
• reviewed 2026-09-21T13:48:50.578Z sha 6dad914 :: needs real behavior proof before merge. :: [P2] Preserve completed accounts when a sibling exceeds the deadline | [P2] Keep Codex credit balances visible in expanded dashboard groups
• reviewed 2026-09-21T14:40:22.698Z sha 564a71e :: needs maintainer review before merge. :: none
• reviewed 2026-09-21T15:16:32.220Z sha 123bb7b :: needs maintainer review before merge. :: none