Add LongCat usage provider#2217
Conversation
Cookie-based web provider for LongCat (Meituan) that surfaces console
token quota (总额度) and fuel-pack balance (加油包) by reading the
longcat.chat platform session, mirroring the Kimi/MiniMax cookie pattern.
Field mapping is locked against captured live responses:
- GET /api/v1/user-current -> data.name
- GET /api/lc-platform/v1/tokenUsage -> data.usage.{total,used,available}Token
- GET /api/lc-platform/v1/pending-fuel-packages -> data.totalQuota + data.list[]
The public API key path exposes no usage endpoint, so usage is read from
the web console session (all longcat.chat cookies are forwarded since the
Meituan passport cookie name is undocumented). The user-current body is
never logged (it carries a session token + phone).
Wires .longcat into the provider/icon enums, descriptor registry, settings
snapshot/builder, implementation registry, logging, widget, cost-usage and
debug switches; adds brand icon, docs provider-id list, CHANGELOG entry and
unit tests covering the live response shapes.
Addresses Codex review on steipete#1697: - user-current now propagates envelope auth failures (HTTP 200 + code 401/403 -> .invalidSession) instead of swallowing them with try?, so expired cookies prompt re-auth rather than reporting an empty snapshot. - Remove the never-assigned todayTokens / freeQuota fields and the unreachable tertiary 'Today' window; LongCat's tokenUsage is a quota snapshot with no per-day figure. - Add envelope unit tests (invalid-session + success unwrap).
Addresses Codex re-review on steipete#1697: resolveCookieOverride read context.env["LONGCAT_MANUAL_COOKIE"] directly, bypassing LongCatSettingsReader.cookieHeader(), so the lower-case longcat_manual_cookie alias and quote-trimming never reached the env fetch path for CLI/daemon users. Route the env value through the reader first. (The P3 changelog 'today's token usage' wording was already dropped during the rebase onto main.)
Addresses Codex re-review on steipete#1697 (2 P2): - Off now fully disables web auth: resolveCookieOverride returns nil when cookieSource is .off, so a lingering LONGCAT_MANUAL_COOKIE env value can no longer keep the web strategy available. - Browser cookie/keychain import is gated to the Auto source only; Manual no longer silently falls back to a browser session when the pasted header is missing/invalid (it surfaces as unavailable instead). - Add regression tests for the Off/Auto env-override gating.
Address maintainer-bar nits before review: - Thread an injectable ProviderHTTPTransport through fetchUsage/get (mirrors the Doubao fetcher) and add scripted-transport tests: 401/403 and blocked 3xx login redirects surface as .invalidSession, and a full live-shaped response maps account + token quota + fuel pack. - Pin fuel-pack parsing to the fields verified against live longcat.chat responses (availableToken / expireTime) instead of probing a speculative list of candidate key names.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 008ed4cae8
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| @MainActor | ||
| func settingsSnapshot(context: ProviderSettingsSnapshotContext) -> ProviderSettingsSnapshotContribution? { | ||
| .longcat(context.settings.longcatSettingsSnapshot(tokenOverride: context.tokenOverride)) |
There was a problem hiding this comment.
This app-side snapshot wiring does not cover the CLI path: TokenAccountCLIContext.makeCookieBackedSnapshot/makeSnapshot has no LongCat case, and the environment resolver does not project a config cookieHeader into LONGCAT_MANUAL_COOKIE. In the scenario where a user runs codexbar usage --provider longcat with LongCat credentials saved in the config, the fetch context is built with settings == nil, so LongCatCookieHeader only sees process env and reports missing cookies even though the config contains them.
Useful? React with 👍 / 👎.
| if let data = try? await self.get( | ||
| self.tokenUsagePath, | ||
| cookieHeader: cookieHeader, | ||
| transport: transport, | ||
| required: false) |
There was a problem hiding this comment.
When /api/v1/user-current succeeds but the actual quota endpoint redirects or returns 401/403 (for example an SSO cookie still identifies the user but the platform session has expired), this try? converts LongCatAPIError.invalidSession into nil and the provider publishes a successful snapshot with no quota data. Auth failures from the protected usage probes should be rethrown while still allowing genuinely optional non-auth failures to be ignored.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
proof: sufficient
|
Codex review: needs real behavior proof before merge. Reviewed July 16, 2026, 4:44 PM ET / 20:44 UTC. Summary Reproducibility: not applicable. This PR adds a new provider rather than repairing an established LongCat contract, and no real current-head account run has been published. Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Maintainer decision needed
Security Review detailsBest possible solution: Land one consolidated LongCat PR that preserves the isolated transport and fixed CLI/auth behavior, supplies redacted live app or terminal proof, and either narrows the cookie set or records explicit approval for same-host whole-jar forwarding. Do we have a high-confidence way to reproduce the issue? Not applicable: this PR adds a new provider rather than repairing an established LongCat contract, and no real current-head account run has been published. Is this the best way to solve the issue? Unclear: the provider architecture and fixed error handling follow established patterns, but the best mergeable solution must consolidate the duplicate branches, provide live proof, and resolve the whole-cookie credential scope. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against bad4bebebc39. Label changesLabel justifications:
Evidence reviewedSecurity concerns:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (7 earlier review cycles)
|
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
@clawsweeper re-review Addressed the prior LongCat findings at 7a9941a: saved config cookies now project into CLI/provider env, optional quota/fuel probes propagate invalid-session auth failures, and non-auth optional failures stay contained. Local verification passed: swift test --filter LongCat; swift test --filter ProviderConfigEnvironmentTests; make check. |
|
🦞👀 Command router queued. I will update this comment with the next step. |
|
@clawsweeper re-review The previous review placeholder for 7a9941a appears stale after its lease expired. Current head fixes saved manual cookie projection into CLI/config fetch contexts and propagates auth failures from LongCat quota probes, with local verification: swift test --filter LongCat; swift test --filter ProviderConfigEnvironmentTests; make check. Please re-review current head. |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
@clawsweeper re-review The review placeholder for 7a9941a expired without a verdict. Current head fixes cookie projection/auth failure handling and has local verification in the PR body. Please re-review current head. |
|
@clawsweeper re-review The review placeholder for 7a9941a expired again without a verdict. CI is clean; current head and PR body include the LongCat cookie/auth fixes and verification. Please re-review current head. |
|
@clawsweeper re-review The review placeholder for 7a9941a expired again without a verdict. CI is clean; current head includes the LongCat fixes and PR verification. Please re-review current head. |
1 similar comment
|
@clawsweeper re-review The review placeholder for 7a9941a expired again without a verdict. CI is clean; current head includes the LongCat fixes and PR verification. Please re-review current head. |
|
Thanks @joeVenner for the clean LongCat implementation and for working through the manual-cookie details. We merged the older overlapping implementation in #1697 after bringing it forward to current Your overlapping manual-cookie and CLI improvements were useful in the comparison. Focused follow-ups for any remaining behavior are welcome. |
3 participants
Summary
Verification
swift test --filter LongCatswift test --filter ProviderConfigEnvironmentTestsmake check