Sync upstream v0.32.1 and Claude OAuth ownership fix

.github/workflows/ci.yml

@@ -23,6 +23,8 @@ jobs:
     timeout-minutes: 70
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Select Xcode 26.1.1 (if present) or fallback to default
         run: |

.github/workflows/release-cli.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag to upload assets to (for example, v0.24)."
+        description: "Release tag/version to package for manual artifact builds; manual runs do not publish."
         required: false
         type: string
 
@@ -69,6 +69,20 @@ jobs:
           uname -m
           swift --version
 
+      - name: Validate release tag
+        if: github.event_name == 'release' || inputs.tag != ''
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "$RELEASE_TAG" ]]; then
+            echo "Missing release tag." >&2
+            exit 1
+          fi
+          if [[ ! "$RELEASE_TAG" =~ ^v[0-9A-Za-z._-]+$ ]]; then
+            echo "Invalid release tag: $RELEASE_TAG" >&2
+            exit 1
+          fi
+
       - name: Install Swift 6.2.1 via swiftly
         if: matrix.platform == 'linux'
         shell: bash
@@ -211,7 +225,7 @@ jobs:
           echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
 
       - name: Upload release assets
-        if: github.event_name == 'release' || inputs.tag != ''
+        if: github.event_name == 'release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
@@ -223,7 +237,7 @@ jobs:
           gh release upload "$TAG" "$OUT_DIR/$ASSET" "$OUT_DIR/$ASSET.sha256" --clobber
 
       - name: Upload workflow artifact (manual runs)
-        if: github.event_name != 'release' && inputs.tag == ''
+        if: github.event_name == 'workflow_dispatch'
         uses: actions/upload-artifact@v6
         with:
           name: codexbar-cli-${{ matrix.name }}
@@ -234,24 +248,32 @@ jobs:
   update-homebrew-tap:
     runs-on: ubuntu-latest
     needs: build-cli
-    if: github.event_name == 'release' || inputs.tag != ''
+    if: github.event_name == 'release'
     steps:
       - name: Resolve release tag
         id: release
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
         shell: bash
         run: |
           set -euo pipefail
-          tag="${{ inputs.tag || github.ref_name }}"
+          tag="${RELEASE_TAG}"
           if [[ -z "$tag" ]]; then
             echo "Missing release tag." >&2
             exit 1
           fi
+          if [[ ! "$tag" =~ ^v[0-9A-Za-z._-]+$ ]]; then
+            echo "Invalid release tag: $tag" >&2
+            exit 1
+          fi
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
           echo "request_id=codexbar-${tag}-${GITHUB_RUN_ID}" >> "$GITHUB_OUTPUT"
 
       - name: Dispatch tap update
         env:
           GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          REQUEST_ID: ${{ steps.release.outputs.request_id }}
         shell: bash
         run: |
           set -euo pipefail
@@ -260,13 +282,13 @@ jobs:
             if gh workflow run update-formula.yml \
               --repo steipete/homebrew-tap \
               -f formula=codexbar \
-              -f tag="${{ steps.release.outputs.tag }}" \
+              -f tag="$RELEASE_TAG" \
               -f repository=steipete/CodexBar \
               -f artifact_template='CodexBarCLI-{tag}-{target}.tar.gz' \
               -f target_aliases='darwin_arm64=macos-arm64,darwin_amd64=macos-x86_64,linux_arm64=linux-aarch64,linux_amd64=linux-x86_64' \
               -f cask=codexbar \
               -f cask_artifact='CodexBar-macos-universal-{version}.zip' \
-              -f request_id="${{ steps.release.outputs.request_id }}"; then
+              -f request_id="$REQUEST_ID"; then
               exit 0
             fi
             if [[ "$attempt" -eq 6 ]]; then
@@ -279,6 +301,7 @@ jobs:
       - name: Wait for tap update
         env:
           GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          REQUEST_ID: ${{ steps.release.outputs.request_id }}
         shell: bash
         run: |
           set -euo pipefail
@@ -288,7 +311,7 @@ jobs:
                 --repo steipete/homebrew-tap \
                 --workflow update-formula.yml \
                 --json databaseId,displayTitle \
-                --jq '.[] | select(.displayTitle | contains("${{ steps.release.outputs.request_id }}")) | .databaseId' 2>/tmp/codexbar-tap-run-list.err \
+                --jq '.[] | select(.displayTitle | contains(env.REQUEST_ID)) | .databaseId' 2>/tmp/codexbar-tap-run-list.err \
                 | head -n1 || true
             )"
             if [[ -n "$run_id" ]]; then

AGENTS.md

@@ -8,6 +8,12 @@ This is the complete development workflow for any AI agent working on CodexBar M
 
 ---
 
+## Mac Upstream Testing Guardrails
+
+- Never run checks or ad-hoc validation that can display macOS Keychain prompts unless explicitly requested.
+- Prefer parser, provider, and state/model tests over live app-bundle flows when behavior is CLI-testable.
+- Use `KeychainNoUIQuery` or stubs for credential paths; do not touch real provider accounts during routine validation.
+
 ## Development Lifecycle
 
 Every feature or fix follows these 7 steps in order:

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.32.1.1 (Mobile 1.9.0 · build 76.1) — 2026-05-31 — upstream v0.32.1 sync
+
+Syncs the Mac app to upstream v0.32.1 while keeping the paired iOS companion at 1.9.0. This release folds in upstream v0.29.1 through v0.32.1.
+
+### Upstream highlights
+
+- Claude OAuth now keeps Claude CLI-owned refresh tokens delegated to Claude Code when CLI storage is present, preventing forced re-login after refresh-token rotation (#1161, #1239).
+- Claude usage refreshes preserve cached credentials during rate limits and transient unauthorized responses.
+- Provider security is tightened by requiring HTTPS before reattaching imported cookies on redirects.
+- Menu-bar startup and open-menu refresh work is deferred/coalesced to reduce focus freezes, keychain prompts, and WebKit CPU spikes.
+- Upstream provider/UI additions include provider search, Spark quota lanes, DeepSeek web-session cost summaries, Alibaba Token Plan endpoint updates, and localization updates.
+
+### Compatibility
+
+- iPhone companion remains iOS 1.9.0. No CloudKit schema deploy is required for this sync by itself.
+- The Sparkle appcast is not updated in this merge commit; it should be regenerated only after the signed release artifacts are created.
+
 ## 0.29.0.1 (Mobile 1.9.0 · build 68.1) — 2026-05-27 — upstream v0.29.0 + iOS 1.9.0
 
 Syncs the Mac app to upstream CodexBar v0.29.0 and ships the paired iOS 1.9.0 companion. Three new providers — Azure OpenAI, Alibaba Token Plan (Bailian), and T3 Chat — plus the upstream v0.28.0 + v0.29.0 fixes.

Package.swift

@@ -17,6 +17,23 @@ let package = Package(
     platforms: [
         .macOS(.v14),
     ],
+    products: {
+        var products: [Product] = [
+            .library(name: "CodexBarCore", targets: ["CodexBarCore"]),
+            .executable(name: "CodexBarCLI", targets: ["CodexBarCLI"]),
+        ]
+
+        #if os(macOS)
+        products.append(contentsOf: [
+            .executable(name: "CodexBar", targets: ["CodexBar"]),
+            .executable(name: "CodexBarClaudeWatchdog", targets: ["CodexBarClaudeWatchdog"]),
+            .executable(name: "CodexBarWidget", targets: ["CodexBarWidget"]),
+            .executable(name: "CodexBarClaudeWebProbe", targets: ["CodexBarClaudeWebProbe"]),
+        ])
+        #endif
+
+        return products
+    }(),
     dependencies: [
         .package(url: "https://github.com/sparkle-project/Sparkle", from: "2.9.1"),
         .package(url: "https://github.com/steipete/Commander", from: "0.2.1"),

README.md

@@ -45,7 +45,7 @@ Download: <https://github.com/steipete/CodexBar/releases>
 
 ### Homebrew
 ```bash
-brew install --cask steipete/tap/codexbar
+brew install --cask codexbar
 ```
 
 ### Linux (CLI only)
@@ -84,6 +84,10 @@ See [CLI configuration](docs/cli-configuration.md) for the full flow.
 - [OpenAI](docs/openai.md) — Admin API key usage/cost graphs with legacy credit-balance fallback.
 - [Claude](docs/claude.md) — OAuth API, browser cookies, or CLI PTY fallback; session and weekly usage where available.
 - [Cursor](docs/cursor.md) — Browser session cookies for plan + usage + billing resets.
+- [OpenCode](docs/opencode.md) — Browser cookies for workspace subscription usage.
+- [OpenCode Go](docs/opencode.md) — Browser cookies for Go usage windows.
+- [Alibaba Coding Plan](docs/alibaba-coding-plan.md) — Web cookies or API key for coding-plan quotas.
+- [Alibaba Token Plan](docs/alibaba-token-plan.md) — Bailian browser/manual cookies for token-plan credits.
 - [Gemini](docs/gemini.md) — OAuth-backed quota API using Gemini CLI credentials (no browser cookies).
 - [Antigravity](docs/antigravity.md) — Local language server probe (experimental); no external auth.
 - [Droid](docs/factory.md) — Browser cookies + WorkOS token flows for Factory usage + billing.
@@ -113,7 +117,7 @@ See [CLI configuration](docs/cli-configuration.md) for the full flow.
 - [Crof](docs/crof.md) — API key for dollar credit balance and request quota tracking.
 - [Command Code](docs/command-code.md) — Browser cookies for monthly USD credits from Command Code billing.
 - [StepFun](docs/stepfun.md) — Username + password login for Step Plan rate limits (5‑hour + weekly windows) and subscription plan name.
-- [AWS Bedrock](docs/bedrock.md) — AWS credentials for Cost Explorer usage and monthly budget tracking.
+- [AWS Bedrock](docs/bedrock.md) — AWS access keys or a named AWS profile (SSO/assume-role via the AWS CLI) for Cost Explorer usage and monthly budget tracking.
 - [Grok](docs/grok.md) — Grok CLI billing RPC plus grok.com browser-session fallback.
 - [GroqCloud](docs/groqcloud.md) — API key for Enterprise Prometheus request/token/cache-hit metrics.
 - [LLM Proxy](docs/llm-proxy.md) — API key + base URL for aggregate proxy quota stats and provider breakdowns.
@@ -205,6 +209,8 @@ Dev loop:
 
 ## Linux desktop integration?
 - [codexbar-waybar](https://github.com/Marouan-chak/codexbar-waybar) — Waybar custom module + GTK4 popover for Hyprland / Sway / other Wayland compositors, built on top of the bundled Linux CLI.
+- [Codexbar GNOME](https://extensions.gnome.org/extension/9841/codexbar/) — GNOME Shell extension that brings CodexBar usage into the desktop panel.
+- [noctalia-codex-usage](https://github.com/rayoplateado/noctalia-codex-usage) — Noctalia/Quickshell plugin that shows Codex 5-hour and weekly usage limits, built on top of the bundled Linux CLI.
 
 ## Credits
 Inspired by [ccusage](https://github.com/ryoppippi/ccusage) (MIT), specifically the cost usage tracking.

Scripts/ci_swift_test_by_suite.py

@@ -38,7 +38,17 @@ def run_command(command: list[str], timeout: int | None = None) -> int:
 
 
 def swift_test_list() -> list[str]:
-    result = subprocess.run(["swift", "test", "list"], check=True, capture_output=True, text=True)
+    result = subprocess.run(["swift", "test", "list"], check=False, capture_output=True, text=True)
+    if result.returncode != 0:
+        print("swift test list failed", file=sys.stderr, flush=True)
+        if result.stdout:
+            print("stdout:", file=sys.stderr, flush=True)
+            print(result.stdout, file=sys.stderr, flush=True)
+        if result.stderr:
+            print("stderr:", file=sys.stderr, flush=True)
+            print(result.stderr, file=sys.stderr, flush=True)
+        returncode = result.returncode
+        raise subprocess.CalledProcessError(returncode, result.args, output=result.stdout, stderr=result.stderr)
     suites: set[str] = set()
     for line in result.stdout.splitlines():
         if "/" not in line:

Scripts/mac-release

@@ -10,8 +10,8 @@ if [[ -n "${MAC_RELEASE_TOOL:-}" ]]; then
 fi
 
 for candidate in \
-  "$ROOT/../agent-scripts/skills/mac-app-release/scripts/mac-release" \
-  "$HOME/Projects/agent-scripts/skills/mac-app-release/scripts/mac-release"; do
+  "$ROOT/../agent-scripts/skills/release-mac-app/scripts/mac-release" \
+  "$HOME/Projects/agent-scripts/skills/release-mac-app/scripts/mac-release"; do
   if [[ -x "$candidate" ]]; then
     exec "$candidate" "$@"
   fi