[sf-jin-ku]

Summary

Bug fix for the Vercel personal AI Gateway budget shipped in v0.78.0 (#4623). With a valid access token, the card always showed "No personal budget configured" even when the user had a budget.

Root cause

GET /v2/user returns the bare user ID (e.g. gW5f…), but budget rows identify users as usr_<id>. The plugin compared scopeId === user.id, so it never found the user's own row. The fixtures used the same string on both sides, which hid the mismatch.

Fixes

1. Budget lookup. Match rows against the usr_-prefixed user ID. Test fixtures now mirror the real shapes: a bare ID from /v2/user and usr_… in budget rows.
2. Team ID is optional. When no Team ID is configured, use defaultTeamId from /v2/user. A configured ID or slug still takes precedence. If neither exists, the refresh fails as missingCredential before any budget request.
   • The settings subtitle now reads "Optional. Defaults to your Vercel default team…", translated in all 23 catalogs.
   • The missing-credential message no longer requires a Team ID.
3. Spend row label. The row used the "spent" catalog key, which translates as an exhausted quota. For example, a normal amount rendered as "할당량 고갈: $8.41" (ko) or "quota épuisé" (fr). It now uses the existing "Spend" key, which every catalog already translates as spend.
4. Token-only setups. These were reported as unconfigured: api_key_missing from config validation, and an unconfigured auth result from codexbar diagnose vercel. PluginProviderSpec gains alternateCredentialKey, and Vercel sets it to VERCEL_ACCESS_TOKEN.
   • The adapter counts that secret for auth detection.
   • It warns only when neither credential is configured.
   • The token is still never treated as the gateway key, so routing and origin isolation are unchanged.

Testing

• Each regression test fails on current main and passes with this change:
  • user-ID matching (25 failures without the fix);
  • default-team fallback, and missing team with no default;
  • spend label;
  • token-only validation and diagnostics.
• The budget fix was checked against the real response shapes of /v2/user and /ai-gateway/budgets/list from a team using a default member budget. The plugin now reports $8.41 / $50.00, weekly, resetting Monday 00:00 UTC, where v0.78.0 showed "No personal budget configured". That data was used only for a local scratch check and is not committed.
• swift test --filter 'VercelBudgetPluginTests|VercelProviderSettingsTests|ConfigValidationTests|PluginProviderSpecTests|ProviderSettingsDescriptorTests|UserFacingLocalizationCoverageTests|LocalizationLanguageCatalogTests' → 184 tests in 7 suites, all passed.
• make check passes, including the locale check.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GYiF6FrNLHsyqZXK1MeD8t

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review blocked

Automated review did not run, so no review verdict was produced.

Reason: The input-safety check rejected material in this revision. No detected value, path, or scanner output is reproduced here.

Automatic review is on hold, including after source changes. Request a fresh re-review after resolving the failure; maintainers can also release the hold through an intentional scanner-policy update.

Next step: If this is a genuine credential, remove and rotate it. If it is an intentional test fixture, a maintainer must review and qualify it.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T07:28:36.799079Z	750ddb9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[steipete]

Merged in ceb44d3, thanks @sf-jin-ku for the quick follow-up! Personal budgets now match both the user's native ID and the usr_-prefixed form the API returns, so they no longer show as unconfigured. We kept the fix narrow and dropped the default-team discovery in favour of the explicit Team ID. It will ship in the next release.