@hashimkarim/usagestat-linux-x64-gnu 2.0.0-alpha.1

package/plugins/codex/plugin.js

@@ -0,0 +1,1009 @@
+(function () {
+  const AUTH_FILE = "auth.json"
+  const CONFIG_AUTH_PATHS = ["~/.config/codex", "~/.codex"]
+  const KEYCHAIN_SERVICE = "Codex Auth"
+  const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+  const REFRESH_URL = "https://auth.openai.com/oauth/token"
+  const USAGE_URL = "https://chatgpt.com/backend-api/wham/usage"
+  const CREDIT_USD_RATE = 0.04
+  const REFRESH_AGE_MS = 8 * 24 * 60 * 60 * 1000
+  const ACCESS_TOKEN_REFRESH_WINDOW_MS = 5 * 60 * 1000
+  const ERR_NOT_LOGGED_IN = "Not logged in. Run `codex` to authenticate."
+  const ERR_SESSION_EXPIRED = "Session expired. Run `codex` to log in again."
+  const ERR_TOKEN_CONFLICT = "Token conflict. Run `codex` to log in again."
+  const ERR_TOKEN_REVOKED = "Token revoked. Run `codex` to log in again."
+  const ERR_TOKEN_EXPIRED = "Token expired. Run `codex` to log in again."
+  const ERR_USAGE_API_KEY = "Usage not available for API key."
+  const ERR_USAGE_CONNECTION = "Usage request failed. Check your connection."
+  const ERR_USAGE_AFTER_REFRESH = "Usage request failed after refresh. Try again."
+
+  function joinPath(base, leaf) {
+    return base.replace(/[\\/]+$/, "") + "/" + leaf
+  }
+
+  function readCodexHome(ctx) {
+    if (!ctx.host.env || typeof ctx.host.env.get !== "function") {
+      return null
+    }
+
+    try {
+      const value = ctx.host.env.get("CODEX_HOME")
+      if (typeof value !== "string") return null
+      const trimmed = value.trim()
+      return trimmed || null
+    } catch (e) {
+      ctx.host.log.warn("CODEX_HOME read failed: " + String(e))
+      return null
+    }
+  }
+
+  function readEnvUrl(ctx, name, fallback) {
+    try {
+      const value = ctx.host.env.get(name)
+      if (typeof value === "string" && value.trim()) return value.trim()
+    } catch {}
+    return fallback
+  }
+
+  function decodeHexUtf8(hex) {
+    try {
+      const bytes = []
+      for (let i = 0; i < hex.length; i += 2) {
+        bytes.push(parseInt(hex.slice(i, i + 2), 16))
+      }
+
+      if (typeof TextDecoder !== "undefined") {
+        try {
+          return new TextDecoder("utf-8", { fatal: false }).decode(new Uint8Array(bytes))
+        } catch {}
+      }
+
+      let escaped = ""
+      for (const b of bytes) {
+        const h = b.toString(16)
+        escaped += "%" + (h.length === 1 ? "0" + h : h)
+      }
+      return decodeURIComponent(escaped)
+    } catch {
+      return null
+    }
+  }
+
+  function tryParseAuthJson(ctx, text) {
+    if (!text) return null
+    const parsed = ctx.util.tryParseJson(text)
+    if (parsed) return parsed
+
+    // Some keychain payloads can be returned as hex-encoded UTF-8 bytes.
+    let hex = String(text).trim()
+    if (hex.startsWith("0x") || hex.startsWith("0X")) hex = hex.slice(2)
+    if (!hex || hex.length % 2 !== 0) return null
+    if (!/^[0-9a-fA-F]+$/.test(hex)) return null
+
+    const decoded = decodeHexUtf8(hex)
+    if (!decoded) return null
+    return ctx.util.tryParseJson(decoded)
+  }
+
+  function resolveAuthPaths(ctx) {
+    const codexHome = readCodexHome(ctx)
+
+    // If CODEX_HOME is set, use it
+    if (codexHome) {
+      return [joinPath(codexHome, AUTH_FILE)]
+    }
+
+    return CONFIG_AUTH_PATHS.map((basePath) => joinPath(basePath, AUTH_FILE))
+  }
+
+  function hasTokenLikeAuth(auth) {
+    if (!auth || typeof auth !== "object") return false
+    if (auth.tokens && auth.tokens.access_token) return true
+    if (auth.OPENAI_API_KEY) return true
+    return false
+  }
+
+  function hasAccessTokenAuth(auth) {
+    return !!(auth && auth.tokens && auth.tokens.access_token)
+  }
+
+  function isAuthFallbackError(e) {
+    if (typeof e !== "string") return false
+    return (
+      e === ERR_SESSION_EXPIRED ||
+      e === ERR_TOKEN_CONFLICT ||
+      e === ERR_TOKEN_REVOKED ||
+      e === ERR_TOKEN_EXPIRED
+    )
+  }
+
+  function loadAuthFromKeychain(ctx) {
+    if (!ctx.host.keychain || typeof ctx.host.keychain.readGenericPassword !== "function") {
+      return null
+    }
+
+    try {
+      const value = ctx.host.keychain.readGenericPassword(KEYCHAIN_SERVICE)
+      if (!value) return null
+      const auth = tryParseAuthJson(ctx, value)
+      if (!hasTokenLikeAuth(auth)) {
+        ctx.host.log.warn("keychain has data but no codex auth payload")
+        return null
+      }
+      ctx.host.log.info("auth loaded from keychain: " + KEYCHAIN_SERVICE)
+      return { auth, authPath: null, source: "keychain" }
+    } catch (e) {
+      ctx.host.log.info("keychain read failed (may not exist): " + String(e))
+      return null
+    }
+  }
+
+  function nativeAuthStorage(ctx) {
+    const settings = (ctx.provider && ctx.provider.settings) || {}
+    return typeof settings.authStorage === "string" ? settings.authStorage : "auto"
+  }
+
+  function loadNativeAuth(ctx) {
+    return JSON.parse(ctx.host.codex.readAuth(nativeAuthStorage(ctx)))
+  }
+
+  function saveAuth(ctx, authState) {
+    const auth = authState && authState.auth ? authState.auth : null
+    if (!auth) return false
+
+    if (authState.source === "native") {
+      if (authState.readOnly) return false
+      ctx.host.codex.writeAuth(nativeAuthStorage(ctx), authState.profileKey, authState.revision, authState.storage, JSON.stringify(auth))
+      return true
+    }
+
+    if (authState.source === "file" && authState.authPath) {
+      ctx.host.fs.writeText(authState.authPath, JSON.stringify(auth, null, 2))
+      return true
+    }
+
+    if (authState.source === "keychain") {
+      if (!ctx.host.keychain || typeof ctx.host.keychain.writeGenericPassword !== "function") {
+        ctx.host.log.warn("keychain write unsupported in this host")
+        return false
+      }
+      // Use compact JSON to avoid newline-induced keychain encoding issues.
+      ctx.host.keychain.writeGenericPassword(KEYCHAIN_SERVICE, JSON.stringify(auth))
+      return true
+    }
+
+    return false
+  }
+
+  function loadFileAuthCandidates(ctx) {
+    const authPaths = resolveAuthPaths(ctx)
+    const candidates = []
+    const missingPaths = []
+    for (const authPath of authPaths) {
+      if (!ctx.host.fs.exists(authPath)) {
+        missingPaths.push(authPath)
+        continue
+      }
+      try {
+        const text = ctx.host.fs.readText(authPath)
+        const auth = tryParseAuthJson(ctx, text)
+        if (!hasTokenLikeAuth(auth)) {
+          ctx.host.log.warn("auth file exists but no valid codex auth payload: " + authPath)
+          continue
+        }
+        ctx.host.log.info("auth loaded from file: " + authPath)
+        candidates.push({ auth, authPath, source: "file" })
+      } catch (e) {
+        ctx.host.log.warn("auth file read failed: " + authPath + ": " + String(e))
+      }
+    }
+
+    return { candidates, missingPaths }
+  }
+
+  function needsRefresh(ctx, auth, nowMs) {
+    const accessToken = auth.tokens && auth.tokens.access_token
+    if (accessToken && ctx.jwt && typeof ctx.jwt.decodePayload === "function") {
+      const payload = ctx.jwt.decodePayload(accessToken)
+      const expiresAtSeconds = payload && payload.exp
+      if (typeof expiresAtSeconds === "number" && Number.isFinite(expiresAtSeconds)) {
+        const expiresAtMs = expiresAtSeconds * 1000
+        return expiresAtMs <= nowMs + ACCESS_TOKEN_REFRESH_WINDOW_MS
+      }
+    }
+
+    if (!auth.last_refresh) return false
+    const lastMs = ctx.util.parseDateMs(auth.last_refresh)
+    if (lastMs === null) return false
+    return nowMs - lastMs > REFRESH_AGE_MS
+  }
+
+  function reloadAuthState(ctx, authState) {
+    let reloaded = null
+    if (authState.source === "file" && authState.authPath) {
+      try {
+        const auth = tryParseAuthJson(ctx, ctx.host.fs.readText(authState.authPath))
+        if (hasTokenLikeAuth(auth)) {
+          reloaded = { auth, authPath: authState.authPath, source: "file" }
+        }
+      } catch (e) {
+        ctx.host.log.warn("auth reload failed for file " + authState.authPath + ": " + String(e))
+      }
+    } else if (authState.source === "native") {
+      reloaded = loadNativeAuth(ctx)
+    } else if (authState.source === "keychain") {
+      reloaded = loadAuthFromKeychain(ctx)
+    }
+
+    if (!reloaded) return { status: "unchanged", authState }
+    if (!hasAccessTokenAuth(reloaded.auth)) {
+      return { status: "error", error: ERR_TOKEN_CONFLICT }
+    }
+
+    const expectedAccountId = authState.auth.tokens && authState.auth.tokens.account_id
+    const reloadedAccountId = reloaded.auth.tokens && reloaded.auth.tokens.account_id
+    if (expectedAccountId && reloadedAccountId !== expectedAccountId) {
+      return { status: "error", error: ERR_TOKEN_CONFLICT }
+    }
+
+    if (JSON.stringify(reloaded.auth) !== JSON.stringify(authState.auth)) {
+      ctx.host.log.info("auth changed during guarded reload, using updated credentials")
+      return { status: "changed", authState: reloaded }
+    }
+    return { status: "unchanged", authState }
+  }
+
+  function refreshToken(ctx, authState) {
+    // Rotating an encrypted store's refresh token without updating that store
+    // would invalidate the CLI session. Let the owning Codex CLI refresh it.
+    if (authState.readOnly) throw ERR_SESSION_EXPIRED
+    const auth = authState.auth
+    if (!auth.tokens || !auth.tokens.refresh_token) {
+      ctx.host.log.warn("refresh skipped: no refresh token")
+      return null
+    }
+
+    ctx.host.log.info("attempting token refresh")
+    try {
+      const resp = ctx.util.request({
+        method: "POST",
+        url: readEnvUrl(ctx, "CODEX_REFRESH_URL", REFRESH_URL),
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        bodyText:
+          "grant_type=refresh_token" +
+          "&client_id=" + encodeURIComponent(CLIENT_ID) +
+          "&refresh_token=" + encodeURIComponent(auth.tokens.refresh_token),
+        timeoutMs: 15000,
+      })
+
+      if (resp.status === 400 || resp.status === 401) {
+        let code = null
+        const body = ctx.util.tryParseJson(resp.bodyText)
+        if (body) {
+          code = body.error?.code || body.error || body.code
+        }
+        ctx.host.log.error("refresh failed: status=" + resp.status + " code=" + String(code))
+        if (code === "refresh_token_expired") {
+          throw ERR_SESSION_EXPIRED
+        }
+        if (code === "refresh_token_reused") {
+          throw ERR_TOKEN_CONFLICT
+        }
+        if (code === "refresh_token_invalidated") {
+          throw ERR_TOKEN_REVOKED
+        }
+        throw ERR_TOKEN_EXPIRED
+      }
+      if (resp.status < 200 || resp.status >= 300) {
+        ctx.host.log.warn("refresh returned unexpected status: " + resp.status)
+        return null
+      }
+
+      const body = ctx.util.tryParseJson(resp.bodyText)
+      if (!body) {
+        ctx.host.log.warn("refresh response not valid JSON")
+        return null
+      }
+      const newAccessToken = body.access_token
+      if (!newAccessToken) {
+        ctx.host.log.warn("refresh response missing access_token")
+        return null
+      }
+
+      auth.tokens.access_token = newAccessToken
+      if (body.refresh_token) auth.tokens.refresh_token = body.refresh_token
+      if (body.id_token) auth.tokens.id_token = body.id_token
+      auth.last_refresh = new Date().toISOString()
+
+      try {
+        const saved = saveAuth(ctx, authState)
+        if (saved) {
+          ctx.host.log.info("refresh succeeded, auth persisted to " + authState.source)
+        } else {
+          ctx.host.log.warn("refresh succeeded but auth persistence was not possible")
+        }
+      } catch (e) {
+        ctx.host.log.warn("refresh succeeded but failed to save auth: " + String(e))
+      }
+
+      return newAccessToken
+    } catch (e) {
+      if (typeof e === "string") throw e
+      ctx.host.log.error("refresh exception: " + String(e))
+      return null
+    }
+  }
+
+  function fetchUsage(ctx, accessToken, accountId) {
+    const headers = {
+      Authorization: "Bearer " + accessToken,
+      Accept: "application/json",
+      "User-Agent": "OpenUsage",
+    }
+    if (accountId) {
+      headers["ChatGPT-Account-Id"] = accountId
+    }
+    return ctx.util.request({
+      method: "GET",
+      url: readEnvUrl(ctx, "CODEX_USAGE_URL", USAGE_URL),
+      headers,
+      timeoutMs: 10000,
+    })
+  }
+
+  function readPercent(value) {
+    const n = Number(value)
+    return Number.isFinite(n) ? n : null
+  }
+
+  function readNumber(value) {
+    const n = Number(value)
+    return Number.isFinite(n) ? n : null
+  }
+
+  function readCreditsRemaining(resp, data) {
+    const credits = data && data.credits && typeof data.credits === "object" ? data.credits : null
+    if (credits) {
+      const bodyBalance = readNumber(credits.balance)
+      if (bodyBalance !== null) return bodyBalance
+      if (credits.has_credits === false) return 0
+    }
+
+    return readNumber(resp.headers["x-codex-credits-balance"])
+  }
+
+  function formatCodexPlan(ctx, planType) {
+    const rawPlan = typeof planType === "string" ? planType.trim() : ""
+    if (!rawPlan) return null
+    if (rawPlan.toLowerCase() === "prolite") return "Pro 5x"
+    if (rawPlan.toLowerCase() === "pro") return "Pro 20x"
+    return ctx.fmt.planLabel(rawPlan) || null
+  }
+
+  function getResetsAtIso(ctx, nowSec, window) {
+    if (!window) return null
+    if (typeof window.reset_at === "number") {
+      return ctx.util.toIso(window.reset_at)
+    }
+    if (typeof window.reset_after_seconds === "number") {
+      return ctx.util.toIso(nowSec + window.reset_after_seconds)
+    }
+    return null
+  }
+
+  // Period durations in milliseconds
+  var PERIOD_SESSION_MS = 5 * 60 * 60 * 1000    // 5 hours
+  var PERIOD_WEEKLY_MS = 7 * 24 * 60 * 60 * 1000 // 7 days
+
+  function queryTokenUsage(ctx) {
+    if (!ctx.host.ccusage || typeof ctx.host.ccusage.query !== "function") {
+      return { status: "no_runner", data: null }
+    }
+
+    const since = new Date()
+    // Inclusive range: today + previous 30 days = 31 calendar days.
+    since.setDate(since.getDate() - 30)
+    const y = since.getFullYear()
+    const m = since.getMonth() + 1
+    const d = since.getDate()
+    const sinceStr = "" + y + (m < 10 ? "0" : "") + m + (d < 10 ? "0" : "") + d
+    const queryOpts = { provider: "codex", since: sinceStr }
+    const codexHome = readCodexHome(ctx)
+    if (codexHome) {
+      queryOpts.homePath = codexHome
+    }
+
+    const result = ctx.host.ccusage.query(queryOpts)
+    if (!result || typeof result !== "object" || typeof result.status !== "string") {
+      return { status: "runner_failed", data: null }
+    }
+    if (result.status !== "ok") {
+      return { status: result.status, data: null }
+    }
+    if (!result.data || !Array.isArray(result.data.daily)) {
+      return { status: "runner_failed", data: null }
+    }
+    return { status: "ok", data: result.data }
+  }
+
+  function fmtTokens(n) {
+    const abs = Math.abs(n)
+    const sign = n < 0 ? "-" : ""
+    const units = [
+      { threshold: 1e9, divisor: 1e9, suffix: "B" },
+      { threshold: 1e6, divisor: 1e6, suffix: "M" },
+      { threshold: 1e3, divisor: 1e3, suffix: "K" },
+    ]
+    for (let i = 0; i < units.length; i++) {
+      const unit = units[i]
+      if (abs >= unit.threshold) {
+        const scaled = abs / unit.divisor
+        const formatted = scaled >= 10
+          ? Math.round(scaled).toString()
+          : scaled.toFixed(1).replace(/\.0$/, "")
+        return sign + formatted + unit.suffix
+      }
+    }
+    return sign + Math.round(abs).toString()
+  }
+
+  function dayKeyFromDate(date) {
+    const year = date.getFullYear()
+    const month = date.getMonth() + 1
+    const day = date.getDate()
+    return year + "-" + (month < 10 ? "0" : "") + month + "-" + (day < 10 ? "0" : "") + day
+  }
+
+  function dayKeyFromUsageDate(rawDate) {
+    if (typeof rawDate !== "string") return null
+    const value = rawDate.trim()
+    if (!value) return null
+
+    const isoMatch = value.match(/^(\d{4})-(\d{2})-(\d{2})$/)
+    if (isoMatch) {
+      return isoMatch[1] + "-" + isoMatch[2] + "-" + isoMatch[3]
+    }
+
+    const isoDatePrefixMatch = value.match(/^(\d{4})-(\d{2})-(\d{2})(?:[Tt\s]|$)/)
+    if (isoDatePrefixMatch) {
+      return isoDatePrefixMatch[1] + "-" + isoDatePrefixMatch[2] + "-" + isoDatePrefixMatch[3]
+    }
+
+    const compactMatch = value.match(/^(\d{4})(\d{2})(\d{2})$/)
+    if (compactMatch) {
+      return compactMatch[1] + "-" + compactMatch[2] + "-" + compactMatch[3]
+    }
+
+    const ms = Date.parse(value)
+    if (!Number.isFinite(ms)) return null
+    return dayKeyFromDate(new Date(ms))
+  }
+
+  function usageCostUsd(day) {
+    if (!day || typeof day !== "object") return null
+
+    if (day.totalCost != null) {
+      const totalCost = Number(day.totalCost)
+      if (Number.isFinite(totalCost)) return totalCost
+    }
+
+    if (day.costUSD != null) {
+      const costUSD = Number(day.costUSD)
+      if (Number.isFinite(costUSD)) return costUSD
+    }
+
+    return null
+  }
+
+  function costAndTokensLabel(data, opts) {
+    const includeZeroTokens = !!(opts && opts.includeZeroTokens)
+    const parts = []
+    if (data.costUSD != null) parts.push("$" + data.costUSD.toFixed(2))
+    if (data.tokens > 0 || (includeZeroTokens && data.tokens === 0)) {
+      parts.push(fmtTokens(data.tokens) + " tokens")
+    }
+    return parts.join(" · ")
+  }
+
+  function modelTokenCount(modelUsage) {
+    if (!modelUsage || typeof modelUsage !== "object") return 0
+    const total = Number(modelUsage.totalTokens)
+    if (Number.isFinite(total) && total > 0) return total
+
+    const fields = [
+      "inputTokens",
+      "cachedInputTokens",
+      "cacheCreationTokens",
+      "cacheReadTokens",
+      "outputTokens",
+      "reasoningOutputTokens",
+    ]
+    let sum = 0
+    for (let i = 0; i < fields.length; i++) {
+      const n = Number(modelUsage[fields[i]])
+      if (Number.isFinite(n) && n > 0) sum += n
+    }
+    return sum
+  }
+
+  function collectModelUsage(daily) {
+    const totals = {}
+    let totalTokens = 0
+    for (let i = 0; i < daily.length; i++) {
+      const day = daily[i]
+      const models = day && day.models
+      if (models && typeof models === "object") {
+        const names = Object.keys(models)
+        for (let j = 0; j < names.length; j++) {
+          const name = names[j]
+          const tokens = modelTokenCount(models[name])
+          if (tokens <= 0) continue
+          totals[name] = (totals[name] || 0) + tokens
+          totalTokens += tokens
+        }
+      }
+
+      const breakdowns = day && day.modelBreakdowns
+      if (Array.isArray(breakdowns)) {
+        for (let j = 0; j < breakdowns.length; j++) {
+          const breakdown = breakdowns[j]
+          const name = String(
+            (breakdown && (breakdown.modelName || breakdown.name || breakdown.model)) || ""
+          ).trim()
+          if (!name) continue
+          const tokens = modelTokenCount(breakdown)
+          if (tokens <= 0) continue
+          totals[name] = (totals[name] || 0) + tokens
+          totalTokens += tokens
+        }
+      }
+    }
+
+    if (totalTokens <= 0) return []
+    return Object.keys(totals)
+      .map((name) => ({ name, tokens: totals[name], percent: (totals[name] / totalTokens) * 100 }))
+      .sort((a, b) => b.tokens - a.tokens || a.name.localeCompare(b.name))
+  }
+
+  function percentLabel(value) {
+    if (value > 0 && value < 0.1) return "<0.1%"
+    const rounded = Math.round(value * 10) / 10
+    return (rounded % 1 === 0 ? String(Math.round(rounded)) : String(rounded)) + "%"
+  }
+
+  function pushModelUsageLines(lines, ctx, daily) {
+    const models = collectModelUsage(daily)
+    for (let i = 0; i < models.length; i++) {
+      const model = models[i]
+      lines.push(ctx.line.text({
+        label: model.name,
+        value: percentLabel(model.percent),
+      }))
+    }
+  }
+
+  function usageDayLabel(rawDate) {
+    const key = dayKeyFromUsageDate(rawDate)
+    if (!key) return String(rawDate || "").slice(0, 10) || "Usage"
+    const month = Number(key.slice(5, 7))
+    const day = Number(key.slice(8, 10))
+    return month + "/" + day
+  }
+
+  function collectUsageChartPoints(daily) {
+    const points = []
+    for (let i = 0; i < daily.length; i++) {
+      const day = daily[i]
+      const tokens = Number(day && day.totalTokens)
+      if (!Number.isFinite(tokens) || tokens < 0) continue
+      const key = dayKeyFromUsageDate(day.date)
+      if (!key) continue
+      points.push({
+        key: key,
+        label: usageDayLabel(day.date),
+        value: tokens,
+        valueLabel: fmtTokens(tokens) + " tokens",
+      })
+    }
+    return points
+      .sort((a, b) => a.key.localeCompare(b.key))
+      .slice(-31)
+      .map((point) => ({
+        label: point.label,
+        value: point.value,
+        valueLabel: point.valueLabel,
+      }))
+  }
+
+  function pushUsageChartLine(lines, ctx, daily) {
+    const points = collectUsageChartPoints(daily)
+    if (points.length === 0) return
+    lines.push(ctx.line.barChart({
+      label: "Usage Trend",
+      points: points,
+      note: "Estimated from local Codex logs for the selected account.",
+      color: "#74AA9C",
+    }))
+  }
+
+  function persistUsageDaily(ctx, daily, displayName) {
+    if (!ctx.host.usageDaily || typeof ctx.host.usageDaily.ingest !== "function") return
+    if (!daily || !daily.length) return
+    try {
+      ctx.host.usageDaily.ingest({ displayName: displayName, daily: daily })
+    } catch (e) { /* ignore */ }
+  }
+
+  function pushDayUsageLine(lines, ctx, label, dayEntry) {
+    const tokens = Number(dayEntry && dayEntry.totalTokens) || 0
+    const cost = usageCostUsd(dayEntry)
+    if (tokens > 0) {
+      lines.push(ctx.line.text({
+        label: label,
+        value: costAndTokensLabel({ tokens: tokens, costUSD: cost })
+      }))
+      return
+    }
+
+    lines.push(ctx.line.text({
+      label: label,
+      value: costAndTokensLabel({ tokens: 0, costUSD: 0 }, { includeZeroTokens: true })
+    }))
+  }
+
+  function probeWithAuthState(ctx, initialAuthState) {
+    let authState = initialAuthState
+    let auth = authState.auth
+
+    if (auth.tokens && auth.tokens.access_token) {
+      const nowMs = Date.now()
+      let accessToken = auth.tokens.access_token
+      let accountId = auth.tokens.account_id
+      let proactiveRefreshAuthError = null
+
+      if (needsRefresh(ctx, auth, nowMs)) {
+        ctx.host.log.info("token needs refresh")
+        const reload = reloadAuthState(ctx, authState)
+        if (reload.status === "error") throw reload.error
+        authState = reload.authState
+        auth = authState.auth
+        accessToken = auth.tokens.access_token
+        accountId = auth.tokens.account_id
+        let refreshed = null
+        if (needsRefresh(ctx, auth, nowMs)) {
+          try {
+            refreshed = refreshToken(ctx, authState)
+          } catch (e) {
+            if (!isAuthFallbackError(e)) throw e
+            proactiveRefreshAuthError = e
+            ctx.host.log.warn("proactive refresh failed, trying existing token: " + String(e))
+          }
+        }
+        if (refreshed) {
+          accessToken = refreshed
+        } else if (!proactiveRefreshAuthError) {
+          ctx.host.log.warn("proactive refresh failed, trying with existing token")
+        }
+      }
+
+      let resp
+      let didRefresh = false
+      let didReloadAuth = false
+      try {
+        resp = ctx.util.retryOnceOnAuth({
+          request: (token) => {
+            try {
+              return fetchUsage(ctx, token || accessToken, accountId)
+            } catch (e) {
+              ctx.host.log.error("usage request exception: " + String(e))
+              if (didRefresh) {
+                throw ERR_USAGE_AFTER_REFRESH
+              }
+              throw ERR_USAGE_CONNECTION
+            }
+          },
+          refresh: () => {
+            const reload = reloadAuthState(ctx, authState)
+            if (reload.status === "error") throw reload.error
+            if (reload.status === "changed") {
+              authState = reload.authState
+              auth = authState.auth
+              accessToken = auth.tokens.access_token
+              accountId = auth.tokens.account_id
+              proactiveRefreshAuthError = null
+              didReloadAuth = true
+              ctx.host.log.info("usage returned 401, retrying with reloaded auth")
+              return accessToken
+            }
+            if (proactiveRefreshAuthError) throw proactiveRefreshAuthError
+            ctx.host.log.info("usage returned 401, attempting refresh")
+            didRefresh = true
+            return refreshToken(ctx, authState)
+          },
+        })
+      } catch (e) {
+        if (typeof e === "string") throw e
+        ctx.host.log.error("usage request failed: " + String(e))
+        throw ERR_USAGE_CONNECTION
+      }
+
+      if (didReloadAuth && ctx.util.isAuthStatus(resp.status)) {
+        ctx.host.log.info("reloaded auth returned 401, attempting refresh")
+        didRefresh = true
+        const refreshed = refreshToken(ctx, authState)
+        if (refreshed) {
+          try {
+            resp = fetchUsage(ctx, refreshed, accountId)
+          } catch (e) {
+            ctx.host.log.error("usage request exception after reloaded auth refresh: " + String(e))
+            throw ERR_USAGE_AFTER_REFRESH
+          }
+        }
+      }
+
+      if (ctx.util.isAuthStatus(resp.status)) {
+        ctx.host.log.error("usage returned auth error after all retries: status=" + resp.status)
+        throw ERR_TOKEN_EXPIRED
+      }
+
+      if (resp.status < 200 || resp.status >= 300) {
+        ctx.host.log.error("usage returned error: status=" + resp.status)
+        throw "Usage request failed (HTTP " + String(resp.status) + "). Try again later."
+      }
+
+      ctx.host.log.info("usage fetch succeeded")
+
+      const data = ctx.util.tryParseJson(resp.bodyText)
+      if (data === null) {
+        throw "Usage response invalid. Try again later."
+      }
+
+      const lines = []
+      const nowSec = Math.floor(Date.now() / 1000)
+      const rateLimit = data.rate_limit || null
+      const primaryWindow = rateLimit && rateLimit.primary_window ? rateLimit.primary_window : null
+      const secondaryWindow = rateLimit && rateLimit.secondary_window ? rateLimit.secondary_window : null
+      const reviewWindow =
+        data.code_review_rate_limit && data.code_review_rate_limit.primary_window
+          ? data.code_review_rate_limit.primary_window
+          : null
+
+      const headerPrimary = readPercent(resp.headers["x-codex-primary-used-percent"])
+      const headerSecondary = readPercent(resp.headers["x-codex-secondary-used-percent"])
+
+      if (headerPrimary !== null) {
+        lines.push(ctx.line.progress({
+          label: "Session",
+          used: headerPrimary,
+          limit: 100,
+          format: { kind: "percent" },
+          resetsAt: getResetsAtIso(ctx, nowSec, primaryWindow),
+          periodDurationMs: PERIOD_SESSION_MS
+        }))
+      }
+      if (headerSecondary !== null) {
+        lines.push(ctx.line.progress({
+          label: "Weekly",
+          used: headerSecondary,
+          limit: 100,
+          format: { kind: "percent" },
+          resetsAt: getResetsAtIso(ctx, nowSec, secondaryWindow),
+          periodDurationMs: PERIOD_WEEKLY_MS
+        }))
+      }
+
+      if (lines.length === 0 && data.rate_limit) {
+        if (data.rate_limit.primary_window && typeof data.rate_limit.primary_window.used_percent === "number") {
+          lines.push(ctx.line.progress({
+            label: "Session",
+            used: data.rate_limit.primary_window.used_percent,
+            limit: 100,
+            format: { kind: "percent" },
+            resetsAt: getResetsAtIso(ctx, nowSec, primaryWindow),
+            periodDurationMs: PERIOD_SESSION_MS
+          }))
+        }
+        if (data.rate_limit.secondary_window && typeof data.rate_limit.secondary_window.used_percent === "number") {
+          lines.push(ctx.line.progress({
+            label: "Weekly",
+            used: data.rate_limit.secondary_window.used_percent,
+            limit: 100,
+            format: { kind: "percent" },
+            resetsAt: getResetsAtIso(ctx, nowSec, secondaryWindow),
+            periodDurationMs: PERIOD_WEEKLY_MS
+          }))
+        }
+      }
+
+      if (Array.isArray(data.additional_rate_limits)) {
+        for (const entry of data.additional_rate_limits) {
+          if (!entry || !entry.rate_limit) continue
+          const name = typeof entry.limit_name === "string" ? entry.limit_name : ""
+          let shortName = name.replace(/^GPT-[\d.]+-Codex-/, "")
+          if (!shortName) shortName = name || "Model"
+          const rl = entry.rate_limit
+          if (rl.primary_window && typeof rl.primary_window.used_percent === "number") {
+            lines.push(ctx.line.progress({
+              label: shortName,
+              used: rl.primary_window.used_percent,
+              limit: 100,
+              format: { kind: "percent" },
+              resetsAt: getResetsAtIso(ctx, nowSec, rl.primary_window),
+              periodDurationMs: typeof rl.primary_window.limit_window_seconds === "number"
+                ? rl.primary_window.limit_window_seconds * 1000
+                : PERIOD_SESSION_MS
+            }))
+          }
+          if (rl.secondary_window && typeof rl.secondary_window.used_percent === "number") {
+            lines.push(ctx.line.progress({
+              label: shortName + " Weekly",
+              used: rl.secondary_window.used_percent,
+              limit: 100,
+              format: { kind: "percent" },
+              resetsAt: getResetsAtIso(ctx, nowSec, rl.secondary_window),
+              periodDurationMs: typeof rl.secondary_window.limit_window_seconds === "number"
+                ? rl.secondary_window.limit_window_seconds * 1000
+                : PERIOD_WEEKLY_MS
+            }))
+          }
+        }
+      }
+
+      if (reviewWindow) {
+        const used = reviewWindow.used_percent
+        if (typeof used === "number") {
+          lines.push(ctx.line.progress({
+            label: "Reviews",
+            used: used,
+            limit: 100,
+            format: { kind: "percent" },
+            resetsAt: getResetsAtIso(ctx, nowSec, reviewWindow),
+            periodDurationMs: PERIOD_WEEKLY_MS // code_review_rate_limit is a 7-day window
+          }))
+        }
+      }
+
+      const resetCredits =
+        data.rate_limit_reset_credits &&
+        typeof data.rate_limit_reset_credits === "object" &&
+        data.rate_limit_reset_credits.available_count != null
+          ? readNumber(data.rate_limit_reset_credits.available_count)
+          : null
+      if (resetCredits !== null && resetCredits >= 0) {
+        lines.push(ctx.line.text({
+          label: "Rate Limit Resets",
+          value: Math.floor(resetCredits) + " available",
+        }))
+      }
+
+      const creditsRemaining = readCreditsRemaining(resp, data)
+      if (creditsRemaining !== null) {
+        const remaining = Math.max(0, Math.floor(creditsRemaining))
+        const usdValue = (remaining * CREDIT_USD_RATE).toFixed(2)
+        lines.push(ctx.line.text({
+          label: "Credits",
+          value: "$" + usdValue + " · " + remaining + " credits",
+        }))
+      }
+
+      let plan = null
+      if (data.plan_type) {
+        const planLabel = formatCodexPlan(ctx, data.plan_type)
+        if (planLabel) {
+          plan = planLabel
+        }
+      }
+
+      try {
+        const tokenUsageResult = queryTokenUsage(ctx)
+        if (tokenUsageResult.status === "ok") {
+          const tokenUsage = tokenUsageResult.data
+          const now = new Date()
+          const todayKey = dayKeyFromDate(now)
+          const yesterday = new Date(now.getTime())
+          yesterday.setDate(yesterday.getDate() - 1)
+          const yesterdayKey = dayKeyFromDate(yesterday)
+
+          let todayEntry = null
+          let yesterdayEntry = null
+          for (let i = 0; i < tokenUsage.daily.length; i++) {
+            const usageDayKey = dayKeyFromUsageDate(tokenUsage.daily[i].date)
+            if (usageDayKey === todayKey) {
+              todayEntry = tokenUsage.daily[i]
+              continue
+            }
+            if (usageDayKey === yesterdayKey) {
+              yesterdayEntry = tokenUsage.daily[i]
+            }
+          }
+
+          pushDayUsageLine(lines, ctx, "Today", todayEntry)
+          pushDayUsageLine(lines, ctx, "Yesterday", yesterdayEntry)
+
+          let totalTokens = 0
+          let totalCostNanos = 0
+          let hasCost = false
+          for (let i = 0; i < tokenUsage.daily.length; i++) {
+            const day = tokenUsage.daily[i]
+            const dayTokens = Number(day.totalTokens)
+            if (Number.isFinite(dayTokens)) {
+              totalTokens += dayTokens
+            }
+
+            const dayCost = usageCostUsd(day)
+            if (dayCost != null) {
+              totalCostNanos += Math.round(dayCost * 1e9)
+              hasCost = true
+            }
+          }
+
+          if (totalTokens > 0) {
+            lines.push(ctx.line.text({
+              label: "Last 30 Days",
+              value: costAndTokensLabel({ tokens: totalTokens, costUSD: hasCost ? totalCostNanos / 1e9 : null })
+            }))
+          }
+
+          pushUsageChartLine(lines, ctx, tokenUsage.daily)
+          persistUsageDaily(ctx, tokenUsage.daily, "Codex")
+        }
+      } catch (e) {
+        ctx.host.log.warn("local Codex token usage failed: " + String(e))
+      }
+
+      if (lines.length === 0) {
+        lines.push(ctx.line.badge({ label: "Status", text: "No usage data", color: "#a3a3a3" }))
+      }
+
+      return { plan: plan, lines: lines }
+    }
+
+    if (auth.OPENAI_API_KEY) {
+      throw ERR_USAGE_API_KEY
+    }
+
+    throw ERR_NOT_LOGGED_IN
+  }
+
+  function probe(ctx) {
+    if (ctx.host.codex && typeof ctx.host.codex.readAuth === "function") {
+      return probeWithAuthState(ctx, loadNativeAuth(ctx))
+    }
+    const fileAuth = loadFileAuthCandidates(ctx)
+    let lastAuthFallbackError = null
+    for (let i = 0; i < fileAuth.candidates.length; i++) {
+      const authState = fileAuth.candidates[i]
+      try {
+        return probeWithAuthState(ctx, authState)
+      } catch (e) {
+        if (!isAuthFallbackError(e)) {
+          throw e
+        }
+        lastAuthFallbackError = e
+        ctx.host.log.warn("auth failed for file " + authState.authPath + ", trying next auth source: " + String(e))
+      }
+    }
+
+    const keychainAuth = loadAuthFromKeychain(ctx)
+    if (keychainAuth) {
+      try {
+        return probeWithAuthState(ctx, keychainAuth)
+      } catch (e) {
+        if (!isAuthFallbackError(e)) throw e
+        lastAuthFallbackError = e
+        ctx.host.log.warn("keychain auth failed: " + String(e))
+      }
+    }
+
+    if (lastAuthFallbackError) throw lastAuthFallbackError
+
+    for (const authPath of fileAuth.missingPaths) {
+      ctx.host.log.warn("auth file not found: " + authPath)
+    }
+
+    ctx.host.log.error("probe failed: not logged in")
+    throw ERR_NOT_LOGGED_IN
+  }
+
+  globalThis.__openusage_plugin = { id: "codex", probe }
+})()