@agentclientprotocol/codex-acp 1.8.0 → 1.9.0

package/dist/index.js

@@ -24051,6 +24051,37 @@ function fallbackName(sessionId) {
   return `Agent ${suffix}`;
 }
 
+// src/RateLimitsMap.ts
+function rateLimitId(snapshot, fallback = "codex") {
+  return snapshot.limitId ?? fallback;
+}
+function createRateLimitsMap(response) {
+  const result = /* @__PURE__ */ new Map();
+  const snapshots = Object.entries(response.rateLimitsByLimitId ?? {}).filter((entry) => entry[1] !== void 0);
+  if (snapshots.length === 0) {
+    snapshots.push([rateLimitId(response.rateLimits), response.rateLimits]);
+  }
+  for (const [fallbackId, snapshot] of snapshots) {
+    const limitId = rateLimitId(snapshot, fallbackId);
+    result.set(limitId, {
+      limitId,
+      limitName: snapshot.limitName ?? limitId,
+      snapshot
+    });
+  }
+  return result;
+}
+function mergeRateLimitSnapshot(previous, update) {
+  return {
+    ...update,
+    limitId: update.limitId ?? "codex",
+    credits: update.credits ?? previous.credits,
+    individualLimit: update.individualLimit ?? previous.individualLimit,
+    spendControlReached: update.spendControlReached ?? previous.spendControlReached,
+    planType: update.planType ?? previous.planType
+  };
+}
+
 // src/CodexEventHandler.ts
 var MAX_SESSION_FAILURE_TITLE_LENGTH = 240;
 var SESSION_FAILURE_POLICY = {
@@ -24159,11 +24190,14 @@ var CodexEventHandler = class _CodexEventHandler {
   terminalCommandOutputIds = /* @__PURE__ */ new Set();
   agentMessagePhases = /* @__PURE__ */ new Map();
   subagents;
+  /** Connection-level `authStatus` sink; the app-server account push feeds it. */
+  onAccountUpdated;
   constructor(connection, sessionState, supportsPlanUpdates = false, supportsTypedSessionFailures = false, sessionFailureEpoch = randomUUID(), subagents = new CodexSubagentEventRouter(
     sessionState.sessionId,
     false,
     new ACPSessionConnection(connection, sessionState.sessionId)
-  )) {
+  ), onAccountUpdated) {
+    this.onAccountUpdated = onAccountUpdated;
     this.sessionState = sessionState;
     this.supportsPlanUpdates = supportsPlanUpdates;
     this.supportsTypedSessionFailures = supportsTypedSessionFailures;
@@ -24387,6 +24421,9 @@ var CodexEventHandler = class _CodexEventHandler {
       case "account/rateLimits/updated":
         this.handleRateLimitsUpdated(notification.params);
         return null;
+      case "account/updated":
+        this.onAccountUpdated?.(notification.params);
+        return null;
       case "configWarning":
         return await this.createConfigWarningEvent(notification.params);
       case "warning":
@@ -24437,7 +24474,6 @@ var CodexEventHandler = class _CodexEventHandler {
       case "turn/moderationMetadata":
       case "item/fileChange/outputDelta":
       case "item/fileChange/patchUpdated":
-      case "account/updated":
       case "fs/changed":
       case "mcpServer/startupStatus/updated":
       case "mcpServer/event/stream/notification":
@@ -25083,11 +25119,13 @@ ${event.stdin}
     if (!this.sessionState.rateLimits) {
       this.sessionState.rateLimits = /* @__PURE__ */ new Map();
     }
-    const limitId = params.rateLimits.limitId ?? params.rateLimits.limitName ?? "unknown";
+    const limitId = params.rateLimits.limitId ?? "codex";
+    const existingEntry = this.sessionState.rateLimits.get(limitId);
+    const snapshot = existingEntry ? mergeRateLimitSnapshot(existingEntry.snapshot, params.rateLimits) : { ...params.rateLimits, limitId };
     this.sessionState.rateLimits.set(limitId, {
       limitId,
-      limitName: params.rateLimits.limitName ?? limitId,
-      snapshot: params.rateLimits
+      limitName: snapshot.limitName ?? existingEntry?.limitName ?? limitId,
+      snapshot
     });
   }
   handleFuzzyFileSearchSessionUpdated(params) {
@@ -27247,7 +27285,7 @@ var package_default = {
   publishConfig: {
     access: "public"
   },
-  version: "1.8.0",
+  version: "1.9.0",
   description: "",
   main: "dist/index.js",
   bin: {
@@ -27310,7 +27348,7 @@ var package_default = {
   },
   dependencies: {
     "@agentclientprotocol/sdk": "^1.4.0",
-    "@openai/codex": "^0.152.0",
+    "@openai/codex": "^0.153.2",
     diff: "^9.0.0",
     open: "^11.0.1",
     "vscode-jsonrpc": "^9.0.1",
@@ -27908,6 +27946,12 @@ var CodexAcpClient = class {
   config;
   modelProvider;
   gatewayConfig;
+  /**
+   * Where the stored gateway routing came from: the `gateway` auth method
+   * (agent-owned authentication) or the ACP `providers/*` API (client-driven
+   * routing). `authStatus` reports only the agent-owned one.
+   */
+  gatewayConfigSource;
   pendingLoginCompleted = null;
   pendingAccountUpdated = null;
   sessionNotificationQueues = /* @__PURE__ */ new Map();
@@ -27919,6 +27963,7 @@ var CodexAcpClient = class {
     this.config = codexConfig ?? {};
     this.modelProvider = modelProvider ?? null;
     this.gatewayConfig = null;
+    this.gatewayConfigSource = null;
     this.subagents = new CodexSubagentSubscriptions(codexClient);
   }
   get appServerClient() {
@@ -27951,6 +27996,7 @@ var CodexAcpClient = class {
       throw RequestError.invalidRequest();
     }
     this.gatewayConfig = null;
+    this.gatewayConfigSource = null;
     switch (authRequest.methodId) {
       case "api-key":
         return await this.authenticateWithApiKey(authRequest);
@@ -28034,7 +28080,7 @@ var CodexAcpClient = class {
       apiType: GatewayAuthMethod._meta.gateway.protocol,
       headers: gatewaySettings.headers,
       providerName: gatewaySettings.providerName
-    });
+    }, "authentication");
     return true;
   }
   readApiKeyFromEnv() {
@@ -28080,6 +28126,11 @@ var CodexAcpClient = class {
         };
     }
   }
+  /**
+   * The provider that actually serves requests, ACP-configured gateway
+   * routing included. Use {@link getAgentConfiguredModelProvider} instead
+   * when asking what the agent itself is configured with (`authStatus`).
+   */
   async getCurrentModelProvider() {
     const sessionModelProvider = this.getModelProvider();
     if (sessionModelProvider !== null) {
@@ -28105,7 +28156,7 @@ var CodexAcpClient = class {
    * method and the ACP `providers/set` method. Throws `invalid_params` for an
    * unsupported protocol or a malformed base URL.
    */
-  applyGatewayConfig(params) {
+  applyGatewayConfig(params, source) {
     const apiType = params.apiType;
     const wireApi = SUPPORTED_GATEWAY_PROTOCOLS[apiType];
     if (!wireApi) {
@@ -28122,6 +28173,7 @@ var CodexAcpClient = class {
       "X-Client-Feature-ID": "codex",
       ...params.headers
     };
+    this.gatewayConfigSource = source;
     this.gatewayConfig = {
       modelProvider: CUSTOM_GATEWAY_PROVIDER_ID,
       config: {
@@ -28186,7 +28238,7 @@ var CodexAcpClient = class {
       apiType: request.apiType,
       baseUrl: request.baseUrl,
       headers: request.headers
-    });
+    }, "acpProviders");
     logger.log("providers/set applied", {
       providerId: request.providerId,
       apiType: request.apiType,
@@ -28202,6 +28254,7 @@ var CodexAcpClient = class {
     const overrideWasActive = this.gatewayConfig !== null;
     if (request.providerId === OPENAI_PROVIDER_ID) {
       this.gatewayConfig = null;
+      this.gatewayConfigSource = null;
     }
     const current = this.gatewayConfig ? {
       apiType: gatewayApiTypeFromConfig(this.gatewayConfig),
@@ -28219,6 +28272,36 @@ var CodexAcpClient = class {
   async getAccount() {
     return this.codexClient.accountRead({ refreshToken: false });
   }
+  async getRateLimits() {
+    return this.codexClient.accountRateLimitsRead();
+  }
+  /**
+   * Presentable name of the gateway the agent itself authenticated against
+   * (the `gateway` auth method), or `null`. Routing that the client
+   * configured through `providers/set` is deliberately not reported here:
+   * `authStatus` describes the agent-owned login only.
+   */
+  getAuthGatewayProviderName() {
+    return this.gatewayConfigSource === "authentication" ? this.gatewayConfig?.config.name ?? null : null;
+  }
+  /** Whether this provider id is client-driven routing set through `providers/set`. */
+  isClientConfiguredProvider(providerId) {
+    return providerId === CUSTOM_GATEWAY_PROVIDER_ID && this.gatewayConfigSource === "acpProviders";
+  }
+  /**
+   * The model provider the agent itself is configured with (launch option or
+   * Codex config), ignoring any ACP-configured gateway routing. The
+   * routing-aware counterpart is {@link getCurrentModelProvider}.
+   */
+  async getAgentConfiguredModelProvider() {
+    const provider = this.getModelProvider();
+    const agentProvider = this.isClientConfiguredProvider(provider) ? this.modelProvider : provider;
+    if (agentProvider !== null) {
+      return agentProvider;
+    }
+    const settingsModelProvider = await this.codexClient.configRead({ includeLayers: false });
+    return settingsModelProvider?.config?.model_provider ?? null;
+  }
   async resumeSession(request, onSubscribed) {
     const additionalDirectories = readAdditionalDirectories(request.cwd, request.additionalDirectories, request._meta);
     await this.refreshSkills(request.cwd, additionalDirectories);
@@ -29473,6 +29556,9 @@ var CodexAppServerClient = class {
   async accountRead(params) {
     return await this.sendRequest({ method: "account/read", params });
   }
+  async accountRateLimitsRead() {
+    return await this.sendRequest({ method: "account/rateLimits/read", params: void 0 });
+  }
   //TODO create type-safe helper
   async awaitTurnCompleted(threadId, turnId) {
     return await new Promise((resolve) => {
@@ -30079,6 +30165,7 @@ var CodexCommands = class {
         return { handled: true, turnCompleted };
       }
       case "status": {
+        await this.refreshRateLimits(sessionState);
         const session = new ACPSessionConnection(this.connection, sessionId);
         const message = this.buildStatusMessage(sessionState);
         await session.update(createAgentTextMessageChunk(message));
@@ -30227,6 +30314,16 @@ var CodexCommands = class {
     ];
     return lines.join("  \n");
   }
+  async refreshRateLimits(sessionState) {
+    try {
+      const response = await this.runWithProcessCheck(() => this.codexAcpClient.getRateLimits());
+      if (response) {
+        sessionState.rateLimits = createRateLimitsMap(response);
+      }
+    } catch (err) {
+      logger.error(`Failed to refresh rate limits for session ${sessionState.sessionId}`, err);
+    }
+  }
   formatAccountInfo(account) {
     if (!account) {
       return "not logged in";
@@ -30257,10 +30354,10 @@ var CodexCommands = class {
       return "data not available yet";
     }
     const used = usage.totalTokens;
-    const percentLeft = Math.round((contextWindow - used) / contextWindow * 100);
+    const percentUsed = Math.round(used / contextWindow * 100);
     const usedFormatted = this.formatTokenCount(used);
     const totalFormatted = this.formatTokenCount(contextWindow);
-    return `${percentLeft}% left (${usedFormatted} used / ${totalFormatted})`;
+    return `${percentUsed}% used (${usedFormatted} used / ${totalFormatted})`;
   }
   formatRateLimitLines(rateLimits) {
     if (!rateLimits || rateLimits.size === 0) {
@@ -30294,8 +30391,31 @@ var CodexCommands = class {
         lines.push(`**${prefix}Credits:** ${rateLimits.credits.balance}`);
       }
     }
+    if (rateLimits.individualLimit) {
+      const limit = rateLimits.individualLimit;
+      const used = this.formatCreditAmount(limit.used);
+      const total = this.formatCreditAmount(limit.limit);
+      if (used !== null && total !== null) {
+        const percentLeft = Math.round(Math.min(100, Math.max(0, limit.remainingPercent)));
+        const resetDate = new Date(limit.resetsAt * 1e3).toLocaleDateString("en-US", { month: "short", day: "numeric" });
+        lines.push(
+          `**${prefix}individual spend limit:** ${percentLeft}% left (${used} of ${total} credits used; resets ${resetDate})`
+        );
+      }
+    }
     return lines;
   }
+  formatCreditAmount(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+      return null;
+    }
+    const value = Number(trimmed);
+    if (!Number.isFinite(value) || value < 0) {
+      return null;
+    }
+    return Math.round(value).toLocaleString("en-US");
+  }
   formatWindowLabel(windowDurationMins) {
     if (windowDurationMins === null) {
       return "Limit";
@@ -31342,6 +31462,139 @@ function numberValue(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 
+// src/AuthStatusMeta.ts
+var AUTH_STATUS_UPDATE_METHOD = "_auth/status_update";
+var AUTH_STATUS_META_KEY = "authStatus";
+function authStatusCapability() {
+  return {};
+}
+var NOT_LOGGED_IN_LABEL = "Not logged in";
+var DEFAULT_GATEWAY_LABEL = "Custom model gateway";
+var PLAN_DISPLAY_NAMES = {
+  free: "Free",
+  go: "Go",
+  plus: "Plus",
+  pro: "Pro",
+  team: "Team",
+  business: "Business",
+  enterprise: "Enterprise",
+  edu: "Edu"
+};
+function planTypePresentable(planType) {
+  if (!planType || planType === "unknown") {
+    return null;
+  }
+  return PLAN_DISPLAY_NAMES[planType] ?? capitalize2(planType);
+}
+function capitalize2(value) {
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+function chatGptLabel(planType) {
+  const plan = planTypePresentable(planType);
+  return plan === null ? "ChatGPT" : `ChatGPT ${plan}`;
+}
+function gatewayStatus(providerName) {
+  const detail = typeof providerName === "string" && providerName.trim().length > 0 ? providerName.trim() : void 0;
+  return {
+    kind: "gateway",
+    label: DEFAULT_GATEWAY_LABEL,
+    ...detail === void 0 ? {} : { detail }
+  };
+}
+function unauthenticatedStatus() {
+  return {
+    kind: "none",
+    label: NOT_LOGGED_IN_LABEL
+  };
+}
+function fromAccount(account) {
+  if (account === null) {
+    return unauthenticatedStatus();
+  }
+  switch (account.type) {
+    case "chatgpt": {
+      const accountInfo = {};
+      if (account.email) {
+        accountInfo.email = account.email;
+      }
+      if (account.planType) {
+        accountInfo.plan = account.planType;
+      }
+      return {
+        kind: "account",
+        label: chatGptLabel(account.planType),
+        ...Object.keys(accountInfo).length > 0 ? { account: accountInfo } : {}
+      };
+    }
+    case "apiKey":
+      return {
+        kind: "api_key",
+        label: "OpenAI API key"
+      };
+    case "amazonBedrock":
+      return {
+        kind: "external",
+        label: "AWS Bedrock"
+      };
+  }
+}
+function fromAccountUpdated(notification, previous) {
+  const authMode = notification.authMode;
+  if (authMode === null) {
+    return unauthenticatedStatus();
+  }
+  switch (authMode) {
+    case "chatgpt":
+    case "chatgptAuthTokens": {
+      const status = {
+        kind: "account",
+        label: chatGptLabel(notification.planType)
+      };
+      const accountInfo = {};
+      const previousEmail = previous?.kind === "account" ? previous.account?.email : void 0;
+      if (previousEmail) {
+        accountInfo.email = previousEmail;
+      }
+      if (notification.planType) {
+        accountInfo.plan = notification.planType;
+      }
+      if (Object.keys(accountInfo).length > 0) {
+        status.account = accountInfo;
+      }
+      return status;
+    }
+    case "apikey":
+      return {
+        kind: "api_key",
+        label: "OpenAI API key"
+      };
+    case "personalAccessToken":
+      return {
+        kind: "api_key",
+        label: "OpenAI personal access token"
+      };
+    case "bedrockApiKey":
+    case "bedrockAccessKeys":
+      return {
+        kind: "external",
+        label: "AWS Bedrock"
+      };
+    case "agentIdentity":
+      return {
+        kind: "external",
+        label: "Agent identity"
+      };
+    case "headers":
+      return gatewayStatus();
+  }
+}
+function sameAuthStatus(previous, next) {
+  if (!previous) {
+    return false;
+  }
+  return previous.kind === next.kind && previous.label === next.label && previous.detail === next.detail && previous.account?.email === next.account?.email && previous.account?.organization === next.account?.organization && previous.account?.plan === next.account?.plan && JSON.stringify(previous.vendor) === JSON.stringify(next.vendor);
+}
+
 // src/AcpExtensions.ts
 var LEGACY_SET_SESSION_MODEL_METHOD = "session/set_model";
 var SESSION_STEERING_METHOD = "_session/steering";
@@ -31525,6 +31778,8 @@ var CodexAcpServer = class _CodexAcpServer {
   clientCapabilities;
   terminalOutputMode;
   booleanConfigOptionsSupported;
+  /** Last `authStatus` pushed to the client; used to suppress duplicates. */
+  currentAuthStatus;
   sessions;
   pendingMcpStartupSessions;
   pendingTurnStarts;
@@ -31561,6 +31816,7 @@ var CodexAcpServer = class _CodexAcpServer {
     this.clientCapabilities = null;
     this.terminalOutputMode = "terminal_output_delta";
     this.booleanConfigOptionsSupported = false;
+    this.currentAuthStatus = null;
     this.availableCommands = this.createAvailableCommands(codexAcpClient);
   }
   createAvailableCommands(client) {
@@ -31568,7 +31824,7 @@ var CodexAcpServer = class _CodexAcpServer {
       this.connection,
       client,
       (operation) => this.runWithProcessCheck(operation),
-      () => this.refreshSessionsAuthState(null)
+      () => this.refreshAuthState(null)
     );
   }
   async initialize(_params) {
@@ -31579,6 +31835,7 @@ var CodexAcpServer = class _CodexAcpServer {
     this.terminalOutputMode = resolveTerminalOutputMode(_params.clientCapabilities);
     this.booleanConfigOptionsSupported = clientSupportsBooleanConfigOptions(_params.clientCapabilities);
     await this.runWithProcessCheck(() => this.codexAcpClient.initialize(_params));
+    this.publishFirstAuthStatusAfterResponse();
     const sessionCapabilities = {
       resume: {},
       list: {},
@@ -31610,6 +31867,11 @@ var CodexAcpServer = class _CodexAcpServer {
           acp: false,
           http: true,
           sse: false
+        },
+        _meta: {
+          // Presence means "this agent pushes `_auth/status_update`". It
+          // never carries a payload, and the client never asks for one.
+          [AUTH_STATUS_META_KEY]: authStatusCapability()
         }
       },
       authMethods: getCodexAuthMethods(_params.clientCapabilities),
@@ -31741,7 +32003,7 @@ var CodexAcpServer = class _CodexAcpServer {
   async handleError(e) {
     if (e.message.includes("log out") || e.message.includes("cloud requirements")) {
       await this.runWithProcessCheck(() => this.codexAcpClient.logout());
-      await this.refreshSessionsAuthState(null);
+      await this.refreshAuthState(null);
       throw RequestError.internalError(`${e.message}
 
 You have been logged out. Please try again.`);
@@ -31922,12 +32184,14 @@ Check ${configPath} and project .codex directories, especially their config.toml
   }
   async getAuthStateForProvider(authProvider) {
     if (!this.authProviderUsesOpenAiAccount(authProvider)) {
+      await this.publishAuthStatus(authProvider, null);
       return {
         account: null,
         authConfigured: true
       };
     }
     const accountResponse = await this.runWithProcessCheck(() => this.codexAcpClient.getAccount());
+    await this.publishAuthStatus(authProvider, accountResponse.account);
     return {
       account: accountResponse.account,
       authConfigured: accountResponse.account !== null || !accountResponse.requiresOpenaiAuth
@@ -32106,7 +32370,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
       logger.log("Authenticate request failed");
       throw RequestError.invalidParams();
     }
-    await this.refreshSessionsAuthState(this.getAuthProviderForAuthenticateRequest(_params));
+    await this.refreshAuthState(this.getAuthProviderForAuthenticateRequest(_params));
     logger.log("Authenticate request completed");
     return {};
   }
@@ -32137,7 +32401,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
   async logout(_params) {
     logger.log("Logout request received");
     await this.runWithProcessCheck(() => this.codexAcpClient.logout());
-    await this.refreshSessionsAuthState(null);
+    await this.refreshAuthState(null);
     logger.log("Logout request completed");
   }
   listProviders(_params) {
@@ -32240,15 +32504,155 @@ Check ${configPath} and project .codex directories, especially their config.toml
       state.modelProvider
     );
   }
+  /** Returns whether the auth state was read (and thus the auth status pushed). */
   async refreshSessionsAuthState(authProvider) {
-    if (this.sessions.size === 0) return;
+    if (this.sessions.size === 0) return false;
     const sessionsToRefresh = [...this.sessions.values()].filter((sessionState) => this.authProvidersMatch(sessionState.authProvider, authProvider));
-    if (sessionsToRefresh.length === 0) return;
+    if (sessionsToRefresh.length === 0) return false;
     const authState = await this.getAuthStateForProvider(authProvider);
     for (const sessionState of sessionsToRefresh) {
       sessionState.account = authState.account;
       sessionState.authConfigured = authState.authConfigured;
     }
+    return true;
+  }
+  /**
+   * Refreshes the sessions of a provider and makes sure the connection-level
+   * `authStatus` is pushed even when no session matched (the empty-screen
+   * login case). Reuses the session refresh read; never adds a second one.
+   */
+  async refreshAuthState(authProvider) {
+    const refreshed = await this.refreshSessionsAuthState(authProvider);
+    if (refreshed) return;
+    try {
+      await this.getAuthStateForProvider(authProvider ?? this.codexAcpClient.getModelProvider());
+    } catch (error51) {
+      logger.log("Failed to refresh auth status", { error: String(error51) });
+    }
+  }
+  /**
+   * Schedules the connection's first `_auth/status_update`: one account read,
+   * pushed whatever it says, including `none`.
+   *
+   * The push must not overtake the `initialize` response. The JSON-RPC layer
+   * writes that response in the microtask that resolves {@link initialize}, so
+   * the read starts from a check-phase callback, which always runs after it.
+   * `initialize` itself never waits for the read.
+   *
+   * "Unconditional" costs nothing extra here: nothing has been pushed yet on
+   * this connection, so {@link setAuthStatus} cannot suppress this one.
+   */
+  publishFirstAuthStatusAfterResponse() {
+    setImmediate(() => void this.publishAuthStatusRead());
+  }
+  /**
+   * Reads the agent-owned identity and pushes it.
+   *
+   * Never rejects: an unreadable source means "nothing to report", not an
+   * error. The client then keeps showing the last pushed value, or "not
+   * reported" when there was none.
+   */
+  async publishAuthStatusRead() {
+    let authStatus;
+    try {
+      authStatus = await this.readAgentAuthIdentity();
+    } catch (error51) {
+      logger.log("Cannot determine auth status", { error: String(error51) });
+      return;
+    }
+    await this.setAuthStatus(authStatus);
+  }
+  /**
+   * Builds the agent-owned auth identity. Routing the client configured
+   * through the ACP `providers/*` API is invisible here: the reported state
+   * is what the agent itself is logged in with. `gateway` stays reserved for
+   * agent-owned gateway state — the `gateway` auth method, or a provider the
+   * user configured in Codex's own config.
+   */
+  async readAgentAuthIdentity() {
+    const authGatewayName = this.codexAcpClient.getAuthGatewayProviderName();
+    if (authGatewayName !== null) {
+      return gatewayStatus(authGatewayName);
+    }
+    const modelProvider = await this.runWithProcessCheck(() => this.codexAcpClient.getAgentConfiguredModelProvider());
+    if (!this.authProviderUsesOpenAiAccount(modelProvider)) {
+      return gatewayStatus(modelProvider);
+    }
+    const accountResponse = await this.runWithProcessCheck(() => this.codexAcpClient.getAccount());
+    return fromAccount(accountResponse.account);
+  }
+  /**
+   * Pushes `_auth/status_update` for the freshly read account of a provider.
+   * Agent-owned gateway authentication wins; a client-driven provider
+   * override is ignored and the agent-owned login is reported instead.
+   */
+  async publishAuthStatus(authProvider, account) {
+    const authGatewayName = this.codexAcpClient.getAuthGatewayProviderName();
+    if (authGatewayName !== null) {
+      await this.setAuthStatus(gatewayStatus(authGatewayName));
+      return;
+    }
+    if (this.authProviderUsesOpenAiAccount(authProvider)) {
+      await this.setAuthStatus(fromAccount(account));
+      return;
+    }
+    if (this.codexAcpClient.isClientConfiguredProvider(authProvider)) {
+      await this.publishAuthStatusRead();
+      return;
+    }
+    await this.setAuthStatus(gatewayStatus(authProvider));
+  }
+  /**
+   * Handles the app-server `account/updated` push: the free freshness channel
+   * for logins and logouts happening outside this connection.
+   */
+  handleAccountUpdated(notification) {
+    void this.applyAccountUpdated(notification);
+  }
+  /**
+   * `account/updated` describes the Codex account only. It must never
+   * overwrite an agent-owned gateway status, which no account event can
+   * invalidate; only a gateway logout or a provider change does.
+   */
+  async applyAccountUpdated(notification) {
+    try {
+      if (this.codexAcpClient.getAuthGatewayProviderName() !== null) {
+        return;
+      }
+      if (this.currentAuthStatus === null) {
+        await this.publishAuthStatusRead();
+        return;
+      }
+      if (this.currentAuthStatus.kind === "gateway") {
+        return;
+      }
+      await this.setAuthStatus(fromAccountUpdated(notification, this.currentAuthStatus));
+    } catch (error51) {
+      logger.log("Failed to apply account update to auth status", { error: String(error51) });
+    }
+  }
+  /**
+   * Stores `next` and pushes `_auth/status_update`.
+   *
+   * A push goes out only when the payload changed. The identity is read on
+   * many occasions — `initialize`, each session create, each `account/updated`
+   * — and almost all of them see the login already reported.
+   * Clients replace their whole state on each update and tolerate duplicates,
+   * so a repeat is harmless, but it is pure noise all the same.
+   *
+   * The first push of a connection always goes out: nothing was reported yet,
+   * so no payload can equal it.
+   */
+  async setAuthStatus(next) {
+    if (sameAuthStatus(this.currentAuthStatus, next)) {
+      return;
+    }
+    this.currentAuthStatus = next;
+    try {
+      await this.connection.notify(AUTH_STATUS_UPDATE_METHOD, { authStatus: next });
+    } catch (error51) {
+      logger.log("Failed to send auth status update", { error: String(error51) });
+    }
   }
   async setSessionMode(_params) {
     logger.log("Set session mode requested", {
@@ -33438,7 +33842,6 @@ Check ${configPath} and project .codex directories, especially their config.toml
     let promptWasCancelled = false;
     let recoverableSessionFailure = sessionState.sessionFailure;
     sessionState.currentTurnId = null;
-    sessionState.lastTokenUsage = null;
     const activePrompt = this.trackActivePrompt(params.sessionId);
     let pendingTurnStart = null;
     const ensurePendingTurnStart = () => {
@@ -33471,7 +33874,8 @@ Check ${configPath} and project .codex directories, especially their config.toml
         clientSupportsPlanUpdates(this.clientCapabilities),
         clientSupportsTypedSessionFailures(this.clientCapabilities),
         this.sessionFailureEpoch,
-        sessionState.subagents
+        sessionState.subagents,
+        (accountUpdated) => this.handleAccountUpdated(accountUpdated)
       );
       eventHandler = promptEventHandler;
       const permissionLifecycle = this.permissionLifecycleContext(sessionState);
@@ -33516,6 +33920,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
       }
       const commandPromise = this.availableCommands.tryHandleCommand(params.prompt, sessionState, {
         onTurnStartPending: () => {
+          sessionState.lastTokenUsage = null;
           ensurePendingTurnStart();
         },
         onTurnStarted: (turnId, threadId) => {
@@ -33612,6 +34017,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
         sessionState.fastModeEnabled,
         sessionState.currentModelSupportsFast
       );
+      sessionState.lastTokenUsage = null;
       ensurePendingTurnStart();
       const sendPromptPromise = this.runWithProcessCheck(
         () => this.codexAcpClient.sendPrompt(

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.4.0",
-    "@openai/codex": "^0.152.0",
+    "@openai/codex": "^0.153.2",
     "diff": "^9.0.0",
     "open": "^11.0.1",
     "vscode-jsonrpc": "^9.0.1",