fix(alibaba-token-plan): personal requests rejected with Workspace.NotAuthorised (hardcoded switchAgent)

[wait2050]

Problem

Alibaba Personal/Solo Token Plan requests could fail with BailianGateway.Workspace.NotAuthorised while CodexBar displayed the misleading API error: 200. This affects the mainland China and Singapore personal-account paths discussed in #2500, #2349, and #2370.

Root cause

The Personal request body forwarded a captured Teams switchAgent value. Alibaba binds that value to a particular workspace, so personal sessions outside that workspace are rejected. Separately, the real gateway error lives in a nested success: false frame inside an outer 200-OK envelope, which the fetcher did not inspect.

Fix

• Remove the captured switchAgent and let the gateway resolve the personal session's workspace.
• Resolve sec_token with the existing best-effort dashboard/user-info/cookie flow and include it only when present.
• Extract nested errorCode and errorMsg values so the provider shows the real gateway failure instead of API error: 200.
• Keep Workspace.NotAuthorised as a provider permission error rather than invalid credentials, preserving valid cached browser sessions instead of evicting and re-importing them.
• Restructure the Personal request context to satisfy the repository's parameter-count lint rule.

Verification

• swift test --filter AlibabaTokenPlan: 50 tests passed, including token presence/absence, captured-agent removal, nested-error extraction, authorization classification, and cache preservation.
• make check: clean SwiftFormat and SwiftLint.
• make test: all 758 selections passed in 64/64 groups on the first pass.
• Autoreview: clean, with no accepted/actionable findings.

No maintainer-side live CN or Singapore validation was possible because those account credentials are not available here. Reporter verification with a Personal/Solo account is requested after the fix ships in the next release.

Thanks @wait2050 for the original investigation and implementation.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 3, 2026, 11:55 AM ET / 15:55 UTC.

ClawSweeper review

What this changes

The PR removes the hardcoded workspace selector from Alibaba Personal/Solo quota requests, sends a dashboard security token when available, surfaces nested gateway errors, and preserves valid sessions on permission failures.

Merge readiness

⛔ Blocked until real behavior proof is added - 2 items remain

Current main still contains the reported hardcoded Alibaba workspace selector, so this PR remains necessary. The proposed repair is coherent and test-backed, but merge should wait for redacted authenticated Personal/Solo after-fix proof from the exact head.

Priority: P2
Reviewed head: a3fd3eba79476d3923da92f83aeeeb794cbe3abe

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The implementation is focused and backed by deterministic tests, but real authenticated provider behavior remains unproven for the submitted head.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR lists automated checks but provides no inspectable redacted authenticated after-fix output for the exact head; add live CLI output or provider logs with private values removed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR lists automated checks but provides no inspectable redacted authenticated after-fix output for the exact head; add live CLI output or provider logs with private values removed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	4 items	Current-main defect: The current Personal request payload contains switchAgent: 1_233_135, which matches the workspace-bound field described by the report. Current provider boundary: The current fetcher owns both security-token resolution and nested error classification, so the PR’s request and cached-session changes are in the appropriate subsystem. Policy and validation: The full AGENTS.md was read; it calls for focused provider/parser validation and cautions against unrequested live provider probes that could access Keychain data.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s Alibaba Token Plan provider turns imported browser cookies into quota API requests and maps responses into usage or authentication state for the menu-bar app and CLI. Personal/Solo request composition and error classification determine whether a cached browser session can display quota data.

flowchart LR
  A[Imported browser cookies] --> B[Alibaba provider]
  B --> C[Personal request builder]
  C --> D[Alibaba quota gateway]
  D --> E[Nested usage or error payload]
  E --> F[Provider cache policy]
  F --> G[Menu bar and CLI]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The PR lists automated checks but provides no inspectable redacted authenticated after-fix output for the exact head; add live CLI output or provider logs with private values removed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - The branch changes request-token and cached-session behavior for existing Alibaba Personal/Solo accounts; no inspectable redacted authenticated run from this exact head establishes the live gateway result yet.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch surface	275 added, 50 removed across 5 files	The change is concentrated in the Alibaba provider, focused tests, documentation, and release context.
Test coverage	139 test lines added, 2 removed	The PR adds targeted request and nested-error coverage for the reported path.

Merge-risk options

Maintainer options:

1. Add authenticated provider proof (recommended)
   Post redacted Personal/Solo CLI output or provider logs from the exact head showing quota retrieval and no session eviction, then refresh review.
2. Pause until an account is available
   Leave this PR open if no appropriate Personal/Solo account can provide redacted after-fix proof, because the external request behavior remains merge-sensitive.

Technical review

Best possible solution:

Merge the focused request and error-handling repair once a Personal/Solo account provides redacted after-fix output for the exact head, retaining deterministic tests for token presence, omitted workspace selection, nested errors, and cache preservation.

Do we have a high-confidence way to reproduce the issue?

Yes, by source: current main sends the literal workspace selector on the Personal request path, the field the report identifies as workspace-bound. A live Personal/Solo account is still required to prove the after-fix external gateway response.

Is this the best way to solve the issue?

Yes: removing the captured workspace selector is the narrowest correction to the source-proven request defect, and optional token/error handling stays within the existing provider request boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against eddf0b4a1809.

Labels

Label changes:

• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

• P2: The PR addresses a bounded Alibaba Personal/Solo provider failure with limited blast radius.
• merge-risk: 🚨 compatibility: Removing a request field and changing permission classification can alter outcomes for cached Personal/Solo sessions.
• merge-risk: 🚨 auth-provider: The PR changes dashboard security-token resolution and session retention after gateway authorization errors.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR lists automated checks but provides no inspectable redacted authenticated after-fix output for the exact head; add live CLI output or provider logs with private values removed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current-main defect: The current Personal request payload contains switchAgent: 1_233_135, which matches the workspace-bound field described by the report. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanUsageFetcher.swift:459, eddf0b4a1809)
• Current provider boundary: The current fetcher owns both security-token resolution and nested error classification, so the PR’s request and cached-session changes are in the appropriate subsystem. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanUsageFetcher.swift:141, eddf0b4a1809)
• Policy and validation: The full AGENTS.md was read; it calls for focused provider/parser validation and cautions against unrequested live provider probes that could access Keychain data. (AGENTS.md:1, eddf0b4a1809)
• Available history: The available local history shows recent Alibaba fetcher maintenance in a current-main merge authored by Peter Steinberger; the partial clone could not retrieve deeper promised history because its GitHub remote was unreachable. (Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanUsageFetcher.swift:459, d3ecebaaa9c9)

Likely related people:

• Peter Steinberger: The most recent locally available history touching the Alibaba usage fetcher is a merge authored by Peter Steinberger; the partial clone did not provide older provenance. (role: recent area contributor; confidence: medium; commits: d3ecebaaa9c9; files: Sources/CodexBarCore/Providers/Alibaba/AlibabaTokenPlanUsageFetcher.swift)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted Personal/Solo live CLI output or provider logs from commit a3fd3eba79476d3923da92f83aeeeb794cbe3abe.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (7 earlier review cycles)

• reviewed 2026-07-31T14:13:45.491Z sha ae1f16c :: needs real behavior proof before merge. :: none
• reviewed 2026-07-31T16:25:23.632Z sha ae1f16c :: needs real behavior proof before merge. :: none
• reviewed 2026-08-02T17:30:08.130Z sha d04c125 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-02T17:47:56.611Z sha a3fd3eb :: needs real behavior proof before merge. :: none
• reviewed 2026-08-02T19:15:45.677Z sha a3fd3eb :: needs real behavior proof before merge. :: none
• reviewed 2026-08-03T11:46:44.600Z sha a3fd3eb :: needs real behavior proof before merge. :: none
• reviewed 2026-08-03T13:54:19.299Z sha a3fd3eb :: needs real behavior proof before merge. :: none