@henryqw/pi-multi-codex 1.0.2 → 1.0.4

package/README.md

@@ -1,6 +1,6 @@
 # `@henryqw/pi-multi-codex`
 
-Add multiple ChatGPT Codex OAuth accounts and start new Pi work on the eligible slot with the most weekly quota. Optional automatic switching can retry an HTTP 429 on another eligible slot.
+Add multiple ChatGPT Codex OAuth accounts and start Pi work on the eligible slot with the most weekly quota. The extension switches away from active five-hour blocks and can retry an HTTP 429 on another eligible slot.
 
 ![Pi showing Codex account quotas and the active footer slot](./example.png)
 ![Flowchart separating fresh-quota startup ranking from broader HTTP 429 failover](./docs/codex-routing-flow.svg)
@@ -13,11 +13,11 @@ pi install npm:@henryqw/pi-multi-codex
 
 ## Works with
 
-| Package | Why |
-| --- | --- |
-| [`@henryqw/pi-footer`](https://pi.henry.wang/extensions/pi-footer) | Improves. Shows the active slot's quota or five-hour block in the footer. |
-| [`@henryqw/pi-subagent`](https://pi.henry.wang/extensions/pi-subagent) | Improves. Isolated children keep Main's active Codex slot. |
-| [`@henryqw/pi-task-models`](https://pi.henry.wang/extensions/pi-task-models) | Improves. Numbered slots share one profile route. |
+| Package | Relationship | Purpose |
+| --- | --- | --- |
+| [`@henryqw/pi-footer`](https://pi.henry.wang/extensions/pi-footer) | Improves | Shows the active slot's quota or five-hour block in the footer. |
+| [`@henryqw/pi-subagent`](https://pi.henry.wang/extensions/pi-subagent) | Improves | Isolated children keep Main's active Codex slot. |
+| [`@henryqw/pi-task-models`](https://pi.henry.wang/extensions/pi-task-models) | Improves | Numbered slots share one profile route. |
 
 ## Use
 
@@ -36,6 +36,8 @@ A numbered slot is one Codex account position in Pi.
 ## Flow
 
 - Before the first agent start, only fresh quota snapshots enter startup ranking. The slot with the most seven-day quota wins.
+- An explicit model selection always wins for the next agent start.
+- Before later agent starts, a known active five-hour block switches to the eligible fresh slot with the most seven-day quota.
 - After HTTP 429, failover can use authenticated, registered, scope-allowed, untried slots with stale or missing quota.
 - Failover skips known active five-hour blocks. It ranks fresh known quota first, then unranked slots by slot number.
 - Routing preserves the model ID.
@@ -45,24 +47,20 @@ A numbered slot is one Codex account position in Pi.
 
 ## Config
 
-Automatic HTTP 429 switching is on by default. To disable it, create `~/.pi/agent/config/pi-multi-codex/config.json`:
+Package-owned: `~/.pi/agent/config/pi-multi-codex/config.json`
 
-```json
-{
-  "autoSwitchOn429": false
-}
-```
+| Name | Description | Values | Default |
+| --- | --- | --- | --- |
+| `autoSwitchOn429` | Switches to another eligible slot after an HTTP 429. | Boolean. | `true` |
 
-The config must contain only `autoSwitchOn429` as a boolean. Invalid config is preserved and disables automatic switching.
+Set `autoSwitchOn429` to `false` to disable automatic switching. The config must contain only this field as a boolean. Invalid config is preserved and disables automatic switching.
 
 ## State and storage
 
 The extension maintains a generated, credential-free quota cache at `~/.pi/agent/config/pi-multi-codex/usage.json`.
 
-## Data, cost, and privacy
+## Limits and recovery
 
 The extension reads `auth.json`. It never writes or refreshes credentials.
 
-## Limits and recovery
-
 Scoped sessions can switch only to exact scoped aliases.

package/extensions/multi-codex.ts

@@ -1,9 +1,9 @@
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
-import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
-import { createConfigStore, extensionConfigDir } from "@henryqw/pi-config-store";
+import { createConfigStore, extensionConfigDir, writePrivateTextFileAtomically } from "@henryqw/pi-config-store";
 import { lock } from "proper-lockfile";
 import {
 	createAssistantMessageEventStream,
@@ -258,22 +258,11 @@ async function saveState(state: UsageState, signal?: AbortSignal): Promise<void>
 	signal?.throwIfAborted();
 	if (state.untrusted) return;
 	const file = cachePath();
-	const directory = extensionConfigDir("pi-multi-codex");
-	await mkdir(directory, { recursive: true, mode: 0o700 });
 	const data = `${JSON.stringify({
 		slots: [...state.slots.values()].sort((a, b) => a.slot - b.slot),
 		locks: [...state.locks.values()].sort((a, b) => a.slot - b.slot),
 	})}\n`;
-	const temporary = `${file}.${randomUUID()}.tmp`;
-	try {
-		await writeFile(temporary, data, { encoding: "utf8", mode: 0o600, flag: "wx", signal });
-		signal?.throwIfAborted();
-		await rename(temporary, file);
-		signal?.throwIfAborted();
-		await chmod(file, 0o600);
-	} finally {
-		await rm(temporary, { force: true }).catch(() => undefined);
-	}
+	await writePrivateTextFileAtomically(file, data, { signal });
 }
 
 async function withCacheMutex<T>(operation: (signal: AbortSignal) => Promise<T>, signal?: AbortSignal): Promise<T> {
@@ -835,6 +824,8 @@ export default function multiCodex(pi: ExtensionAPI): void {
 	let sessionContext: ExtensionContext | undefined;
 	let automaticOpen = false;
 	let automaticCandidate: Model<any> | undefined;
+	let preserveModelChoice = false;
+	let selectingAutomatically = false;
 	let autoSwitchOn429 = true;
 	let configWarned = false;
 	let providerRequest: { provider?: string; status?: number } | undefined;
@@ -921,8 +912,17 @@ export default function multiCodex(pi: ExtensionAPI): void {
 		if (ctx) ctx.ui.setStatus?.("pi-multi-codex", footerText(ctx));
 	};
 
+	const setModelAutomatically = async (model: Model<any>): Promise<boolean> => {
+		selectingAutomatically = true;
+		try {
+			return await pi.setModel(model);
+		} finally {
+			selectingAutomatically = false;
+		}
+	};
+
 	const updatePendingCandidate = (ctx: ExtensionContext): void => {
-		if (!automaticOpen || !ctx.model || !isManagedProvider(ctx.model.provider)) return;
+		if (!ctx.model || !isManagedProvider(ctx.model.provider)) return;
 		const slot = selectFreshSlot(ctx, ctx.model);
 		automaticCandidate = slot ? { ...ctx.model, provider: providerForSlot(slot) } : ctx.model;
 	};
@@ -941,6 +941,7 @@ export default function multiCodex(pi: ExtensionAPI): void {
 		sessionContext = ctx;
 		triedSlots.clear();
 		providerRequest = undefined;
+		preserveModelChoice = false;
 		try {
 			autoSwitchOn429 = configStore.loadSync().value.autoSwitchOn429;
 		} catch {
@@ -962,14 +963,17 @@ export default function multiCodex(pi: ExtensionAPI): void {
 	pi.on("before_agent_start", async (_event, ctx) => {
 		triedSlots.clear();
 		providerRequest = undefined;
-		if (!automaticOpen) return;
 		const model = ctx.model;
+		const slot = slotForProvider(model?.provider ?? "");
+		const identity = slot ? currentIdentity(slot) : undefined;
+		const snapshot = slot ? quota.snapshot(slot) : undefined;
+		if (!automaticOpen && (preserveModelChoice || !identity || snapshot?.accountHash !== identity.accountHash || !isFiveHourLimited(snapshot, Date.now()))) return;
 		updatePendingCandidate(ctx);
 		// Close before await: no timer, refresh, queued turn, or provider event can route later.
 		automaticOpen = false;
 		const candidate = automaticCandidate;
 		if (!model || !candidate || !isManagedProvider(model.provider) || candidate.id !== model.id || candidate.provider === model.provider) return;
-		await pi.setModel(candidate);
+		await setModelAutomatically(candidate);
 		updateFooter(ctx);
 	});
 
@@ -1002,7 +1006,7 @@ export default function multiCodex(pi: ExtensionAPI): void {
 		syncSlots();
 		for (const slot of failoverSlots(ctx, model)) {
 			const provider = providerForSlot(slot);
-			if (!await pi.setModel({ ...model, provider })) continue;
+			if (!await setModelAutomatically({ ...model, provider })) continue;
 			ctx.ui.notify(`Codex #${failedSlot} returned HTTP 429. Retrying with Codex #${slot}.`, "warning");
 			updateFooter(ctx);
 			return { message: { ...event.message, errorMessage: `HTTP 429: ${event.message.errorMessage ?? "Codex request was rate limited."}` } };
@@ -1018,6 +1022,7 @@ export default function multiCodex(pi: ExtensionAPI): void {
 
 	pi.on("agent_start", (_event, ctx) => {
 		automaticOpen = false;
+		preserveModelChoice = false;
 		if (!sessionHasAgentWork(ctx)) pi.appendEntry(AGENT_STARTED_ENTRY);
 	});
 	pi.on("agent_settled", () => {
@@ -1032,8 +1037,9 @@ export default function multiCodex(pi: ExtensionAPI): void {
 		quota.stop();
 	});
 	pi.on("model_select", (_event, ctx) => {
-		// Explicit selector choice wins over startup routing.
+		// Explicit selector choice wins over routing at the next agent boundary.
 		automaticOpen = false;
+		if (!selectingAutomatically) preserveModelChoice = true;
 		syncSlots();
 		quota.requestRefresh();
 		updateFooter(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@henryqw/pi-multi-codex",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Use multiple ChatGPT Codex OAuth accounts in Pi.",
   "keywords": [
     "pi-package",
@@ -46,7 +46,7 @@
     "image": "https://raw.githubusercontent.com/HenryQW/pi-harness/main/extensions/pi-multi-codex/example.png"
   },
   "dependencies": {
-    "@henryqw/pi-config-store": "^1.0.0",
+    "@henryqw/pi-config-store": "^1.1.0",
     "proper-lockfile": "^4.1.2"
   },
   "devDependencies": {