Guard Mistral billing costs

[joeVenner]

Summary

• ignore non-finite Mistral billing prices before building the price index
• discard finite prices whose multiplication overflows instead of propagating infinity
• reuse the guarded cost path for monthly totals and daily model breakdowns
• add regression coverage for NaN, Infinity, and finite overflow input

Production-path proof

A temporary standalone executable linked against CodexBarCore called the public MistralUsageFetcher.fetchUsage with in-memory HTTP fixtures. The temporary target was removed after the run.

$ swift run --disable-sandbox --scratch-path .build MistralPriceProof
Build of product MistralPriceProof complete!
price=NaN cost=0.0 finite=true
price=Infinity cost=0.0 finite=true
price=1e308 cost=0.0 finite=true

This exercises the shipping fetch/decode/aggregation path without accessing browser cookies or a live account.

Testing

• swift test --disable-sandbox --filter MistralUsageParserTests (21 tests passed across matched Mistral suites)
• make check (SwiftFormat clean; SwiftLint 0 violations; later host plist write failed because the sandbox cannot write the system cache directory)
• git diff --check

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 4, 2026, 2:45 PM ET / 18:45 UTC.

Summary
The branch guards Mistral billing cost aggregation against non-finite prices and overflow, adds focused parser/fetcher regression coverage, and adds an unreleased changelog note.

Reproducibility: yes. from source inspection: current main accepts non-finite Mistral price doubles and adds multiplied costs directly into totals. I did not run tests because this cleanup review is read-only.

Review metrics: 1 noteworthy metric.

• Patch scope: 3 files changed; 2 code/test files plus 1 changelog line. The implementation stays within Mistral billing parsing and focused regression coverage, with no dependency, script, or settings surface changes.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

• No ClawSweeper repair lane is needed; the remaining action is normal required CI completion and maintainer merge review.

Security
Cleared: The diff only changes Mistral billing parsing, focused tests, and an unreleased changelog note; it adds no dependencies, scripts, credential handling, or supply-chain surface.

Review details

Best possible solution:

Land the bounded Mistral parser guard after required CI completes, keeping validation on fixture-based fetch/parser tests unless a maintainer explicitly asks for live account probing.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main accepts non-finite Mistral price doubles and adds multiplied costs directly into totals. I did not run tests because this cleanup review is read-only.

Is this the best way to solve the issue?

Yes; centralizing finite-price, finite-cost, and finite-sum guards in the Mistral parser path is the narrow maintainable fix, and the added tests cover the malformed inputs.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against cfd747f8d232.

Label changes

Label justifications:

• P2: This is a normal provider-specific correctness fix for billing cost parsing with limited blast radius.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal proof from the public Mistral fetch/decode/aggregation path using in-memory HTTP fixtures, which is appropriate real behavior proof for this parser fix.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal proof from the public Mistral fetch/decode/aggregation path using in-memory HTTP fixtures, which is appropriate real behavior proof for this parser fix.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its provider/parser testing guidance, no-live-Keychain/browser-probe rule, and release-owned CHANGELOG guidance were applied to this review. (AGENTS.md:1, cfd747f8d232)
• Current main vulnerable path: Current main builds Mistral prices with Double(priceStr) without checking isFinite and adds aggregate model costs directly into totalCost, so NaN/Infinity or overflowing multiplication can propagate into monthly totals. (Sources/CodexBarCore/Providers/Mistral/MistralUsageFetcher.swift:319, cfd747f8d232)
• Proposed finite guard: The PR filters non-finite price values before inserting them into the price index and routes model/monthly totals through a finite-accumulation helper. (Sources/CodexBarCore/Providers/Mistral/MistralUsageFetcher.swift:313, 85c708be9db8)
• Overflow guard helper: The proposed cost(for:) returns zero for non-finite multiplication results, and accumulateFiniteCost skips both non-finite inputs and additions that would overflow the running total. (Sources/CodexBarCore/Providers/Mistral/MistralUsageFetcher.swift:417, 85c708be9db8)
• Regression coverage: The PR adds Swift Testing coverage for NaN, Infinity, 1e308 multiplication overflow, and finite individual costs whose sum would overflow, including daily/model breakdown assertions. (Tests/CodexBarTests/MistralUsageParserTests.swift:50, 85c708be9db8)
• Proof and live PR state: The PR body includes terminal proof from a temporary executable exercising MistralUsageFetcher.fetchUsage with in-memory HTTP fixtures; GitHub reports the PR mergeable with no reviews requesting changes at inspection time. (85c708be9db8)

Likely related people:

• steipete: Git blame/log tie the current Mistral parser and model conversion surface to the v0.38.1 release boundary and recent Mistral balance metrics work by Peter Steinberger. (role: introduced behavior and recent area contributor; confidence: high; commits: f84a171bca1b, bc29d89ab483, 9d7e45fb9c4b; files: Sources/CodexBarCore/Providers/Mistral/MistralUsageFetcher.swift, Sources/CodexBarCore/Providers/Mistral/MistralModels.swift, Tests/CodexBarTests/MistralUsageParserTests.swift)
• Mathieu Santostefano: The repository history shows the Mistral provider, parser, models, and parser tests were introduced in commit 47a4776 authored by Mathieu Santostefano. (role: original Mistral provider contributor; confidence: medium; commits: 47a4776e914d; files: Sources/CodexBarCore/Providers/Mistral/MistralUsageFetcher.swift, Sources/CodexBarCore/Providers/Mistral/MistralModels.swift, Tests/CodexBarTests/MistralUsageParserTests.swift)
• joeVenner: Beyond authoring this PR, the same contributor has prior merged adjacent hardening for non-finite OpenAI cost values, which is directly relevant to provider cost parsing. (role: adjacent non-finite cost contributor; confidence: medium; commits: cfb0ac53d15f; files: Sources/CodexBarCore/Providers/OpenAI/OpenAIAPIUsageResponses.swift, Tests/CodexBarTests/OpenAIAPIUsageFetcherTests.swift)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-04T14:18:51.408Z sha cdf6704 :: needs maintainer review before merge. :: none