Merge upstream CodexBar main

.github/workflows/upstream-monitor.yml

@@ -78,16 +78,24 @@ jobs:
           UPSTREAM_BRANCH=$(remote_default_branch upstream)
           UPSTREAM_REF="upstream/${UPSTREAM_BRANCH}"
           UPSTREAM_VERSION=$(awk -F= '$1 == "UPSTREAM_VERSION" {print $2; exit}' version.env)
-          UPSTREAM_BASE_REF="upstream/${UPSTREAM_VERSION}"
-          if [ -z "$UPSTREAM_VERSION" ] || ! git rev-parse --verify -q "$UPSTREAM_BASE_REF" >/dev/null; then
-            echo "Could not resolve UPSTREAM_VERSION=${UPSTREAM_VERSION:-<unset>} from version.env" >&2
+          UPSTREAM_MONITOR_BASE=$(awk -F= '$1 == "UPSTREAM_MONITOR_BASE" {print $2; exit}' version.env)
+          if [ -n "$UPSTREAM_MONITOR_BASE" ]; then
+            UPSTREAM_BASE_REF="$UPSTREAM_MONITOR_BASE"
+            UPSTREAM_BASE_LABEL="$UPSTREAM_MONITOR_BASE"
+          else
+            UPSTREAM_BASE_REF="upstream/${UPSTREAM_VERSION}"
+            UPSTREAM_BASE_LABEL="$UPSTREAM_VERSION"
+          fi
+          if [ -z "$UPSTREAM_BASE_REF" ] || ! git rev-parse --verify -q "$UPSTREAM_BASE_REF" >/dev/null; then
+            echo "Could not resolve upstream monitor base ${UPSTREAM_BASE_REF:-<unset>} from version.env" >&2
             exit 1
           fi
           echo "upstream_ref=$UPSTREAM_REF" >> $GITHUB_OUTPUT
           echo "upstream_version=$UPSTREAM_VERSION" >> $GITHUB_OUTPUT
           echo "upstream_base_ref=$UPSTREAM_BASE_REF" >> $GITHUB_OUTPUT
+          echo "upstream_base_label=$UPSTREAM_BASE_LABEL" >> $GITHUB_OUTPUT
 
-          # Count new commits since the upstream version last recorded in version.env.
+          # Count new commits since the upstream ref last reviewed/merged by QuotaKit.
           UPSTREAM_NEW=$(git log --oneline "${UPSTREAM_BASE_REF}..${UPSTREAM_REF}" --no-merges 2>/dev/null | wc -l | tr -d ' ')
           echo "upstream_commits=$UPSTREAM_NEW" >> $GITHUB_OUTPUT
 
@@ -105,12 +113,14 @@ jobs:
             const upstreamRef = '${{ steps.check.outputs.upstream_ref }}';
             const upstreamVersion = '${{ steps.check.outputs.upstream_version }}';
             const upstreamBaseRef = '${{ steps.check.outputs.upstream_base_ref }}';
+            const upstreamBaseLabel = '${{ steps.check.outputs.upstream_base_label }}';
             const upstreamBranch = upstreamRef.replace('upstream/', '');
             const upstreamSummary = `${{ steps.check.outputs.upstream_summary }}`;
 
             const body = `## Upstream Changes Detected
 
-            **steipete/CodexBar:** ${upstreamCommits} new commits since \`${upstreamVersion}\`
+            **steipete/CodexBar:** ${upstreamCommits} new commits since \`${upstreamBaseLabel}\`
+            **Last shipped upstream version:** \`${upstreamVersion}\`
             **Source refs:** ${upstreamBaseRef}..${upstreamRef}
 
             ### steipete/CodexBar Recent Commits
@@ -131,7 +141,7 @@ jobs:
             \`\`\`
 
             ### Links
-            - [steipete commits](https://github.com/steipete/CodexBar/compare/${upstreamVersion}...steipete:CodexBar:${upstreamBranch})
+            - [steipete commits](https://github.com/steipete/CodexBar/compare/${upstreamBaseLabel}...steipete:CodexBar:${upstreamBranch})
 
             ---
             *Auto-generated by upstream-monitor workflow*
@@ -159,7 +169,7 @@ jobs:
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 issue_number: issues.data[0].number,
-                body: `Updated with latest steipete/CodexBar changes (${upstreamCommits} upstream commits since ${upstreamVersion})`
+                body: `Updated with latest steipete/CodexBar changes (${upstreamCommits} upstream commits since ${upstreamBaseLabel})`
               });
             } else {
               // Create new issue

AGENTS.md

@@ -70,7 +70,7 @@ xcodebuild -project CodexBarMobile/CodexBarMobile.xcodeproj \
   CODE_SIGNING_ALLOWED=NO build
 ```
 
-Never run checks that can display macOS Keychain prompts unless the user explicitly asks for live provider validation. Prefer parser tests, stubs, test stores, or no-UI keychain queries.
+Never run tests/checks or ad-hoc validation that can display macOS Keychain prompts unless the user explicitly asks for live provider validation; use parser tests, stubs, test stores, or `KeychainNoUIQuery`.
 
 ## Release Configuration
 

CHANGELOG.md

@@ -5,6 +5,15 @@ Notable QuotaKit Mac and cross-platform release changes are documented here.
 Older upstream history is intentionally preserved in Git, but this file now focuses
 on Columbus Labs QuotaKit releases and product-facing changes.
 
+## Upcoming
+
+### Changed
+
+- Synced trusted upstream CodexBar Mac improvements after `v0.32.4`, including
+  Codex account/auth hardening, MiniMax quota fixes, menu performance updates,
+  merged provider-switching hang fixes, Claude probe cleanup,
+  Antigravity/Alibaba/Cursor fixes, and additional Mac localizations.
+
 ## 0.32.4.4 / iOS 1.11.1 — 2026-06-08
 
 ### Fixed

Scripts/check_upstreams.sh

@@ -67,31 +67,40 @@ echo -e "${BLUE}==> Upstream (steipete/CodexBar) changes:${NC}"
 UPSTREAM_BRANCH=$(remote_default_branch upstream)
 UPSTREAM_REF="upstream/${UPSTREAM_BRANCH}"
 UPSTREAM_VERSION=$(awk -F= '$1 == "UPSTREAM_VERSION" {print $2; exit}' version.env)
-UPSTREAM_BASE_REF="upstream/${UPSTREAM_VERSION}"
-if [ -z "$UPSTREAM_VERSION" ] || ! git rev-parse --verify -q "$UPSTREAM_BASE_REF" >/dev/null; then
-    echo -e "${RED}Error: Could not resolve UPSTREAM_VERSION=${UPSTREAM_VERSION:-<unset>} from version.env.${NC}" >&2
+UPSTREAM_MONITOR_BASE=$(awk -F= '$1 == "UPSTREAM_MONITOR_BASE" {print $2; exit}' version.env)
+if [ -n "$UPSTREAM_MONITOR_BASE" ]; then
+    UPSTREAM_BASE_REF="$UPSTREAM_MONITOR_BASE"
+    UPSTREAM_BASE_LABEL="$UPSTREAM_MONITOR_BASE"
+else
+    UPSTREAM_BASE_REF="upstream/${UPSTREAM_VERSION}"
+    UPSTREAM_BASE_LABEL="$UPSTREAM_VERSION"
+fi
+if [ -z "$UPSTREAM_BASE_REF" ] || ! git rev-parse --verify -q "$UPSTREAM_BASE_REF" >/dev/null; then
+    echo -e "${RED}Error: Could not resolve upstream monitor base ${UPSTREAM_BASE_REF:-<unset>} from version.env.${NC}" >&2
     exit 1
 fi
 
 UPSTREAM_COUNT=$(git log --oneline "${UPSTREAM_BASE_REF}..${UPSTREAM_REF}" --no-merges 2>/dev/null | wc -l | tr -d ' ')
 
 if [ "$UPSTREAM_COUNT" -gt 0 ]; then
-    echo -e "${GREEN}Found $UPSTREAM_COUNT new commits since $UPSTREAM_VERSION${NC}"
+    echo -e "${GREEN}Found $UPSTREAM_COUNT new commits since $UPSTREAM_BASE_LABEL${NC}"
+    echo "Last shipped upstream version: $UPSTREAM_VERSION"
     echo ""
     git log --oneline --graph "${UPSTREAM_BASE_REF}..${UPSTREAM_REF}" --no-merges | head -20 || true
     echo ""
     echo -e "${YELLOW}Files changed:${NC}"
     git diff --stat "${UPSTREAM_BASE_REF}..${UPSTREAM_REF}" | tail -20 || true
 else
-    echo -e "${GREEN}No new commits since $UPSTREAM_VERSION${NC}"
+    echo -e "${GREEN}No new commits since $UPSTREAM_BASE_LABEL${NC}"
+    echo "Last shipped upstream version: $UPSTREAM_VERSION"
 fi
 echo ""
 
 # Summary
 echo -e "${BLUE}==> Summary${NC}"
-echo "Upstream commits since $UPSTREAM_VERSION: $UPSTREAM_COUNT"
+echo "Upstream commits since $UPSTREAM_BASE_LABEL: $UPSTREAM_COUNT"
 
 echo ""
 echo -e "${YELLOW}Next steps:${NC}"
 echo "  Review upstream: ./Scripts/review_upstream.sh upstream"
-echo "  Detailed diff:   git diff upstream/$UPSTREAM_VERSION..upstream/$UPSTREAM_BRANCH"
+echo "  Detailed diff:   git diff $UPSTREAM_BASE_REF..upstream/$UPSTREAM_BRANCH"

Sources/CodexBar/CodexAccountUsageSnapshotStore.swift

@@ -14,11 +14,53 @@ struct FileCodexAccountUsageSnapshotStore: CodexAccountUsageSnapshotStoring, @un
 
     private struct Record: Codable {
         let id: String
+        let accountIdentity: AccountIdentity?
         let snapshot: UsageSnapshot?
         let error: String?
         let sourceLabel: String?
     }
 
+    private struct AccountIdentity: Codable, Equatable {
+        let normalizedEmail: String?
+        let workspaceAccountID: String?
+        let authFingerprint: String?
+        let storedAccountID: UUID?
+        let selectionSource: CodexActiveSource?
+
+        init(account: CodexVisibleAccount) {
+            self.normalizedEmail = CodexIdentityResolver.normalizeEmail(account.email)
+            self.workspaceAccountID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(
+                account.workspaceAccountID)
+            self.authFingerprint = CodexAuthFingerprint.normalize(account.authFingerprint)
+            self.storedAccountID = account.storedAccountID
+            self.selectionSource = account.selectionSource
+        }
+
+        func matches(_ account: CodexVisibleAccount) -> Bool {
+            guard self.normalizedEmail == CodexIdentityResolver.normalizeEmail(account.email) else {
+                return false
+            }
+
+            let currentWorkspaceAccountID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(
+                account.workspaceAccountID)
+            if self.workspaceAccountID != nil || currentWorkspaceAccountID != nil {
+                return self.workspaceAccountID == currentWorkspaceAccountID
+            }
+
+            let currentAuthFingerprint = CodexAuthFingerprint.normalize(account.authFingerprint)
+            if self.authFingerprint != nil || currentAuthFingerprint != nil {
+                return self.authFingerprint == currentAuthFingerprint
+            }
+
+            if self.storedAccountID != nil || account.storedAccountID != nil {
+                return self.storedAccountID == account.storedAccountID
+            }
+
+            guard let selectionSource else { return true }
+            return selectionSource == account.selectionSource
+        }
+    }
+
     private static let currentVersion = 1
 
     private let fileURL: URL
@@ -41,6 +83,11 @@ struct FileCodexAccountUsageSnapshotStore: CodexAccountUsageSnapshotStoring, @un
         let accountsByID = Dictionary(uniqueKeysWithValues: accounts.map { ($0.id, $0) })
         return payload.records.compactMap { record in
             guard let account = accountsByID[record.id] else { return nil }
+            guard record.accountIdentity?.matches(account)
+                ?? Self.canHydrateLegacyRecord(record, account: account)
+            else {
+                return nil
+            }
             return CodexAccountUsageSnapshot(
                 account: account,
                 snapshot: record.snapshot,
@@ -55,6 +102,7 @@ struct FileCodexAccountUsageSnapshotStore: CodexAccountUsageSnapshotStoring, @un
             records: snapshots.map { snapshot in
                 Record(
                     id: snapshot.id,
+                    accountIdentity: AccountIdentity(account: snapshot.account),
                     snapshot: snapshot.snapshot,
                     error: snapshot.error,
                     sourceLabel: snapshot.sourceLabel)
@@ -77,6 +125,17 @@ struct FileCodexAccountUsageSnapshotStore: CodexAccountUsageSnapshotStoring, @un
         }
     }
 
+    private static func canHydrateLegacyRecord(_ record: Record, account: CodexVisibleAccount) -> Bool {
+        guard record.accountIdentity == nil else { return false }
+        let normalizedID = CodexIdentityResolver.normalizeEmail(record.id)
+        let normalizedEmail = CodexIdentityResolver.normalizeEmail(account.email)
+        let isEmailOnlyVisibleID = normalizedID == normalizedEmail
+        guard isEmailOnlyVisibleID else { return true }
+        return CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(account.workspaceAccountID) == nil &&
+            account.storedAccountID == nil &&
+            CodexAuthFingerprint.normalize(account.authFingerprint) == nil
+    }
+
     static func defaultURL() -> URL {
         let base = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask).first
             ?? FileManager.default.homeDirectoryForCurrentUser

Sources/CodexBar/CodexLoginRunner.swift

@@ -16,18 +16,23 @@ struct CodexLoginRunner {
         let output: String
     }
 
-    static func run(homePath: String? = nil, timeout: TimeInterval = 120) async -> Result {
+    static func run(
+        homePath: String? = nil,
+        timeout: TimeInterval = 120,
+        environment: [String: String] = ProcessInfo.processInfo.environment,
+        loginPATH: [String]? = LoginShellPathCache.shared.current) async -> Result
+    {
         await Task(priority: .userInitiated) {
-            var env = ProcessInfo.processInfo.environment
+            var env = environment
             env["PATH"] = PathBuilder.effectivePATH(
                 purposes: [.rpc, .tty, .nodeTooling],
                 env: env,
-                loginPATH: LoginShellPathCache.shared.current)
+                loginPATH: loginPATH)
             env = CodexHomeScope.scopedEnvironment(base: env, codexHome: homePath)
 
             guard let executable = BinaryLocator.resolveCodexBinary(
                 env: env,
-                loginPATH: LoginShellPathCache.shared.current)
+                loginPATH: loginPATH)
             else {
                 return Result(outcome: .missingBinary, output: "")
             }
@@ -42,6 +47,11 @@ struct CodexLoginRunner {
             process.standardOutput = stdout
             process.standardError = stderr
 
+            let termination = ProcessTermination()
+            process.terminationHandler = { _ in
+                termination.resolve(timedOut: false)
+            }
+
             var processGroup: pid_t?
             do {
                 try process.run()
@@ -50,7 +60,7 @@ struct CodexLoginRunner {
                 return Result(outcome: .launchFailed(error.localizedDescription), output: "")
             }
 
-            let timedOut = await self.wait(for: process, timeout: timeout)
+            let timedOut = await self.wait(timeout: timeout, termination: termination)
             if timedOut {
                 self.terminate(process, processGroup: processGroup)
             }
@@ -68,23 +78,60 @@ struct CodexLoginRunner {
         }.value
     }
 
-    private static func wait(for process: Process, timeout: TimeInterval) async -> Bool {
-        await withTaskGroup(of: Bool.self) { group -> Bool in
-            group.addTask {
-                process.waitUntilExit()
-                return false
+    private final class ProcessTermination: @unchecked Sendable {
+        private let lock = NSLock()
+        private var timedOut: Bool?
+        private var continuation: CheckedContinuation<Bool, Never>?
+
+        func resolve(timedOut: Bool) {
+            let continuation: CheckedContinuation<Bool, Never>?
+            self.lock.lock()
+            guard self.timedOut == nil else {
+                self.lock.unlock()
+                return
             }
-            group.addTask {
-                let nanos = UInt64(max(0, timeout) * 1_000_000_000)
-                try? await Task.sleep(nanoseconds: nanos)
-                return true
+            self.timedOut = timedOut
+            continuation = self.continuation
+            self.continuation = nil
+            self.lock.unlock()
+            continuation?.resume(returning: timedOut)
+        }
+
+        func wait() async -> Bool {
+            await withCheckedContinuation { continuation in
+                let timedOut: Bool?
+                self.lock.lock()
+                timedOut = self.timedOut
+                if timedOut == nil {
+                    self.continuation = continuation
+                }
+                self.lock.unlock()
+
+                if let timedOut {
+                    continuation.resume(returning: timedOut)
+                }
             }
-            let result = await group.next() ?? false
-            group.cancelAll()
-            return result
         }
     }
 
+    private static func wait(timeout: TimeInterval, termination: ProcessTermination) async -> Bool {
+        let timeoutTask = Task.detached(priority: .userInitiated) {
+            try? await Task.sleep(nanoseconds: self.timeoutNanoseconds(timeout))
+            if Task.isCancelled == false {
+                termination.resolve(timedOut: true)
+            }
+        }
+        let timedOut = await termination.wait()
+        timeoutTask.cancel()
+        return timedOut
+    }
+
+    private static func timeoutNanoseconds(_ timeout: TimeInterval) -> UInt64 {
+        guard timeout.isFinite else { return UInt64.max }
+        let seconds = max(0, min(timeout, Double(UInt64.max) / 1_000_000_000))
+        return UInt64(seconds * 1_000_000_000)
+    }
+
     private static func terminate(_ process: Process, processGroup: pid_t?) {
         if let pgid = processGroup {
             kill(-pgid, SIGTERM)