@llblab/pi-kit 0.38.2 → 0.38.4

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.38.4: Bundled Package Updates (2026-11-08)
+
+- `Exact pins`: `@llblab/pi-codex-usage` 0.13.2 → 0.13.4.
+- `Packaging`: Synchronizes the lockfile, bundle aliases and README inventory. Package membership and resource order remain unchanged; packed validation does not certify extension safety or installed-client behavior.
+
+## 0.38.3: Bundled Package Updates (2026-11-01)
+
+- `Exact pins`: `@llblab/pi-state-flow` 0.27.1 → 0.27.4.
+- `Packaging`: Synchronizes the lockfile, bundle aliases and README inventory. Package membership and resource order remain unchanged; packed validation does not certify extension safety or installed-client behavior.
+
 ## 0.38.2: Bundled Package Updates (2026-10-30)
 
 - `Exact pins`: `@llblab/pi-claude-usage` 0.2.4 → 0.2.5.

package/README.md

@@ -15,9 +15,9 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-actors`](https://github.com/llblab/pi-actors) | `0.55.0` | Inspectable local Runs, reusable Recipes, persistent tools, and delegation Skills |
 | [`@llblab/pi-claude-usage`](https://github.com/llblab/pi-claude-usage) | `0.2.5` | Claude subscription quota status and shared per-model Fast toggle for Opus, mirrored in Telegram |
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.3.1` | Isolated nested Pi TUI with named npm extensions and compatible model selection |
-| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.13.2` | OpenAI/legacy Codex subscription quota and Business credit status, with persistent priority Fast toggle mirrored in Telegram |
+| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.13.4` | OpenAI/legacy Codex subscription quota and Business credit status, with persistent priority Fast toggle mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
-| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.27.1` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
+| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.27.4` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
 | [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.58.3` | Telegram companion with per-prompt Steer, queued controls, Reroute/Restore, recoverable connections, previews, follower Threads, files, and voice |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
@@ -25,7 +25,7 @@ Versions are exact by design. An upstream release does not change an installed k
 
 ## Install
 
-Requires **Pi 1.0.0+** and **Node.js 22.19.0+**. State Flow requires its canonical checkpoint/tail storage format and does not convert unsupported stores in place. Preserve existing stores and consult the [owning package's storage guidance](https://github.com/llblab/pi-state-flow/blob/v0.27.1/docs/usage.md#moving-a-store-and-supported-formats) before changing installations.
+Requires **Pi 1.0.0+** and **Node.js 22.19.0+**. State Flow requires its canonical checkpoint/tail storage format and does not convert unsupported stores in place. Preserve existing stores and consult the [owning package's storage guidance](https://github.com/llblab/pi-state-flow/blob/v0.27.4/docs/usage.md#moving-a-store-and-supported-formats) before changing installations.
 
 From NPM:
 

package/node_modules/@llblab/pi-codex-usage/AGENTS.md

@@ -2,11 +2,11 @@
 
 - `Registry dependency`: Use published `@llblab/pi-command-fast@^0.1.0` with aligned registry lock metadata. Local folder links are only for explicitly requested development tests; rebuild the library's `dist/` after source edits and restore registry dependency/locks before consumer publication.
 - `Pi baseline`: Every declared `@earendil-works/*` peer requires ≥1.0.0. Keep Pi peer lock identities aligned and validate against that host generation.
-- `Domain DAG`: `index.ts` only re-exports the extension and public contracts; `lib/extension.ts` composes the Pi extension. `lib/usage-store.ts` owns persistence/leadership, `lib/query.ts` owns quota I/O, `lib/usage.ts` owns normalized reports, `lib/status.ts` and `lib/status-format.ts` own local UI orchestration and formatting, `lib/telegram.ts` owns optional registration, and `lib/fast.ts` owns Codex Fast semantics/request adaptation. `@llblab/pi-command-fast` owns command arbitration and generic JSONC override editing. Keep dependency direction acyclic; do not import `index.ts` from `lib/` or mix Fast persistence into quota coordination. Place domain tests in `tests/<domain>.test.ts` (or a domain-prefixed focused integration test); use independent names such as `invariants.test.ts` only for cross-domain invariants.
+- `Domain DAG`: `index.ts` only re-exports the extension and public contracts; `lib/extension.ts` composes the Pi extension. `lib/usage-store.ts` owns persistence/leadership, `lib/query.ts` owns auth candidate discovery and quota I/O, `lib/usage.ts` owns normalized reports, `lib/status.ts` and `lib/status-format.ts` own local UI orchestration and formatting, `lib/telegram.ts` owns optional registration, and `lib/fast.ts` owns Codex Fast semantics/request adaptation. `@llblab/pi-command-fast` owns command arbitration and generic JSONC override editing. Keep dependency direction acyclic; do not import `index.ts` from `lib/` or mix Fast persistence into quota coordination. Place domain tests in `tests/<domain>.test.ts` (or a domain-prefixed focused integration test); use independent names such as `invariants.test.ts` only for cross-domain invariants.
 - `Statusline-first scope`: Own usage state + usage mode: keep quota reporting zero-configuration and the optional Fast toggle focused on the existing terminal status.
   - Trigger: Considering new commands, menus, persisted settings, or notification output.
   - Action: Prefer deleting the surface unless it is required for the optimistic TUI status widget, the optional `pi-telegram` `/start` status-line mirror, or the existing argument-free `/fast` command. Register both `openai-codex` and `openai` provider handlers through `registerFastProvider` on session_start and release both on session_shutdown; never register `/fast` directly or filter Fast by model ID/auth. Fast persists solely as `serviceTier: "priority"` in the current provider/model override (never share preferences across providers with the same model ID); OFF deletes only that property. Preserve JSONC/unrelated settings, existing wire tiers, and usage refresh/Telegram. Apply lowercase ` fast` through the final terminal boundary; the optional Telegram row reads the active model's Fast preference at render time and appends plain-text ` fast` (or shows `fast` alone without quota). Toggle redraws without quota fetch or success notification. The library owns session WeakMap/reload arbitration, not Fast state. A Fast config read failure must not block usage status.
-- `OpenAI provider support`: Show the same Codex subscription quota for active `openai-codex` and `openai` models. Quota transport accepts `openai` subscription OAuth (guarded by `modelRegistry.isUsingOAuth`) and legacy `openai-codex` auth, with the Codex CLI fallback; never send `openai` API-key credentials to the ChatGPT quota endpoint or label Codex quotas as API billing limits.
+- `OpenAI provider support`: Show the same Codex subscription quota for active `openai-codex` and `openai` models. Recognize both Pi OAuth methods: legacy `openai-codex` credentials and compatible `openai` Sign in with ChatGPT tokens (guarded by `modelRegistry.isUsingOAuth` and a `chatgpt_account_id` claim/header). The newer `openai` token is scoped for `api.openai.com/v1` and rejected by `/wham/usage`, so record it as unavailable instead of sending it. Try legacy Pi auth, compatible new Pi auth, then the local Codex CLI `auth.json` directly before the preserved app-server fallback; never send `openai` API-key credentials to the ChatGPT quota endpoint or label Codex quotas as API billing limits.
 - `Optimistic refresh`: Preserve the last good statusline bar during refresh and transient failures.
   - Trigger: Updating quota polling or error handling.
   - Action: Do not collapse the bar while a request is in flight; only show `n/a` or `error` after repeated failures or no usable quota.

package/node_modules/@llblab/pi-codex-usage/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.13.4: Direct Pi/Codex Auth Hotfix
+
+- Fixed the primary quota request falling back to Codex CLI app-server when Pi uses the newer `openai` Sign in with ChatGPT login. The extension recognizes both Pi OpenAI OAuth methods, records the newer API-scoped token as unavailable for `/wham/usage`, and uses legacy-compatible Pi or local Codex CLI credentials for the direct request before the preserved app-server fallback.
+- Compatible credentials now supply `ChatGPT-Account-Id` from Pi headers or the token claim; API keys, non-ChatGPT CLI credentials, and expired tokens are skipped, and JWTs in endpoint error bodies are redacted. The app-server fallback and Windows executable resolution are unchanged.
+- No configuration changes or cache migration are required; restart Pi to load the updated extension.
+
 ## 0.13.2: Empty Quota Bar Hotfix
 
 - Aligned quota bars with rounded remaining percentages: when either window rounds to `0%`, its final segment disappears and the whole dual bar uses the error background, while the other half retains its quota. The 5-hour reset countdown follows the same zero boundary; near-full quota still rounds to the nearest 5% step.

package/node_modules/@llblab/pi-codex-usage/README.md

@@ -22,7 +22,7 @@ This repository is a minimal fork of [`narumiruna/pi-extensions/extensions/pi-co
 - Models under either `openai-codex` or `openai` show the same primary Codex subscription quota and `codex` status label (not OpenAI API billing limits)
 - When `pi-telegram` is available, the same compact value appears as `codex: <value>` in the `/start` menu status text for either supported provider
 - Additional returned quota buckets are ignored
-- Pi subscription auth from `openai` or legacy `openai-codex` is used first
+- Both Pi OpenAI OAuth methods are detected; legacy-compatible Pi/Codex CLI credentials are used for the direct quota request
 - Codex CLI app-server remains available as a fallback
 - Missing auth, subscription, plan, or quota windows are shown as `n/a`, not as an error
 - Successful updates briefly redraw the bar only when a 5% segment changes
@@ -137,7 +137,7 @@ codex error
 
 ## Shared Refresh
 
-[`index.ts`](./index.ts) is a re-export-only Pi entrypoint; [`lib/extension.ts`](./lib/extension.ts) composes the live extension. [`lib/usage-store.ts`](./lib/usage-store.ts) owns cross-instance quota coordination, [`lib/query.ts`](./lib/query.ts) owns provider requests, [`lib/usage.ts`](./lib/usage.ts) owns quota normalization, [`lib/status.ts`](./lib/status.ts) and [`lib/status-format.ts`](./lib/status-format.ts) own lifecycle and terminal display, [`lib/telegram.ts`](./lib/telegram.ts) adapts the optional Telegram row, and [`lib/fast.ts`](./lib/fast.ts) owns Codex Fast semantics and the native payload bridge; the shared library owns JSONC and command arbitration. Domain tests live under [`tests/`](./tests/) with matching names; integration tests name the domain whose boundary they exercise.
+[`index.ts`](./index.ts) is a re-export-only Pi entrypoint; [`lib/extension.ts`](./lib/extension.ts) composes the live extension. [`lib/usage-store.ts`](./lib/usage-store.ts) owns cross-instance quota coordination, [`lib/query.ts`](./lib/query.ts) owns auth candidate discovery and provider requests, [`lib/usage.ts`](./lib/usage.ts) owns quota normalization, [`lib/status.ts`](./lib/status.ts) and [`lib/status-format.ts`](./lib/status-format.ts) own lifecycle and terminal display, [`lib/telegram.ts`](./lib/telegram.ts) adapts the optional Telegram row, and [`lib/fast.ts`](./lib/fast.ts) owns Codex Fast semantics and the native payload bridge; the shared library owns JSONC and command arbitration. Domain tests live under [`tests/`](./tests/) with matching names; integration tests name the domain whose boundary they exercise.
 
 All Codex models and instances coordinate through `~/.pi/agent/tmp/pi-codex-usage/usage.json` (quota percentages and timestamps only, no tokens). The Claude extension uses its own independent file at `~/.pi/agent/tmp/pi-claude-usage/usage.json`.
 
@@ -169,12 +169,16 @@ The value is the same compact quota bar plus weekly reset countdown used by the
 
 The extension tries usage sources in this order:
 
-1. Pi's subscription auth from `openai` or legacy `openai-codex` (active model first)
-2. `codex app-server --listen stdio://`
+1. Pi's legacy `openai-codex` subscription OAuth, resolved through `modelRegistry.getApiKeyAndHeaders()`
+2. Pi's newer `openai` Sign in with ChatGPT OAuth, when its token carries a Codex account claim
+3. The local Codex CLI `auth.json` ChatGPT credential, read directly without spawning a process
+4. `codex app-server --listen stdio://`
+
+The `/wham/usage` endpoint accepts legacy Codex-shaped OAuth tokens and rejects the newer `openai` Sign in with ChatGPT token: it is scoped for `api.openai.com/v1`, has no `chatgpt_account_id` claim, and returns 401 even when an account header is supplied. The extension detects that token, records it as unavailable, and does not send it to the quota endpoint. Both Pi login methods are recognized; use `/login openai-codex` for a directly usable Pi credential, or keep the Codex CLI logged in for the direct local auth source. Compatible tokens get `ChatGPT-Account-Id` from Pi headers or the token's `https://api.openai.com/auth` claim. The Codex CLI source reads `$CODEX_HOME/auth.json` (default `~/.codex/auth.json`), accepts ChatGPT-mode credentials (`auth_mode: "chatgpt"` or legacy files without a mode), skips expired tokens, and never persists tokens.
 
 On Windows, the fallback resolves the native `codex.exe` from PATH or from the npm platform package behind a `codex.cmd` shim, then launches it directly without a shell. If Codex is missing, install it with `npm install -g @openai/codex@latest` and restart Pi so it inherits the updated PATH.
 
-Selecting an `openai` model enables the status and Fast toggle, and its ChatGPT subscription OAuth credentials can fetch the quota directly; a legacy `openai-codex` provider is not required. The extension uses Pi's resolved auth headers/token, checks `modelRegistry.isUsingOAuth` before using `openai` credentials, and keeps the Codex CLI fallback. OpenAI API keys are not ChatGPT subscription auth and do not expose these quotas; `openai` API-key credentials are skipped, not sent to the ChatGPT quota endpoint. Without subscription auth/quota, the quota status is `n/a` when both sources report an unavailable state. Fast works independently of subscription auth.
+Selecting an `openai` model enables the status and Fast toggle. The extension uses Pi's resolved auth headers/token, checks `modelRegistry.isUsingOAuth` before using `openai` credentials, and keeps the Codex CLI fallback. OpenAI API keys are not ChatGPT subscription auth and do not expose these quotas; `openai` API-key credentials are skipped, not sent to the ChatGPT quota endpoint. Without subscription auth/quota, the quota status is `n/a` when all sources report an unavailable state. Fast works independently of subscription auth.
 
 ## License
 

package/node_modules/@llblab/pi-codex-usage/lib/query.ts

@@ -1,16 +1,31 @@
-/** Domain: quota transport. Owns: Pi auth, Codex app-server fallback and errors. Excludes: shared leadership and UI. */
+/** Domain: quota transport. Owns: Pi/Codex auth candidates, guarded HTTP/RPC quota requests and errors. Excludes: shared leadership and UI. */
 import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { assertObject, errorMessage, isOpenAICodexModel, normalizeAppServerResponse, normalizeBackendPayload, parseJsonObject, selectUsageSnapshot, type AppServerRateLimitResponse, type CodexUsageModel, type CodexUsageReport, type RateLimitStatusPayload, type UsageQueryError } from "./usage.ts";
+import { assertObject, errorMessage, isOpenAICodexModel, normalizeAppServerResponse, normalizeBackendPayload, parseJsonObject, selectUsageSnapshot, type AppServerRateLimitResponse, type CodexUsageModel, type CodexUsageReport, type RateLimitStatusPayload, type UsageQueryError, type UsageSource } from "./usage.ts";
 const CODEX_USAGE_LIMIT_ID = "codex";
 const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+const CODEX_USAGE_ACCOUNT_HEADER = "ChatGPT-Account-Id";
+const OPENAI_AUTH_CLAIM = "https://api.openai.com/auth";
+const LEGACY_PROVIDER = "openai-codex";
+const NEW_PROVIDER = "openai";
+const USER_AGENT = "pi-codex-usage";
+const TOKEN_EXPIRY_MARGIN_MS = 60_000;
 const MAX_ERROR_BODY_CHARS = 600;
 type PiModel = NonNullable<ExtensionContext["model"]>;
 type QueryUsageOptions = { timeoutMs: number };
 export type QueryUsageResult = { ok: true; report: CodexUsageReport } | { ok: false; errors: UsageQueryError[] };
+type QuotaAuthCandidate = {
+  source: UsageSource;
+  headers: Record<string, string>;
+};
+type QuotaAuthResolution = {
+  candidates: QuotaAuthCandidate[];
+  errors: UsageQueryError[];
+};
 type RpcResponse = {
   id?: unknown;
   result?: unknown;
@@ -29,15 +44,15 @@ export async function queryUsage(
   mayQuery: () => boolean,
 ): Promise<QueryUsageResult | undefined> {
   const errors: UsageQueryError[] = [];
-  const sources = ["pi-auth", "codex-app-server"] as const;
+  if (!mayQuery()) return undefined;
+  const auth = await resolveQuotaAuthCandidates(ctx);
+  errors.push(...auth.errors);
+  if (!mayQuery()) return undefined;
 
-  for (const source of sources) {
+  for (const candidate of auth.candidates) {
     if (!mayQuery()) return undefined;
     try {
-      const report =
-        source === "pi-auth"
-          ? await queryViaPiAuth(ctx, options.timeoutMs, mayQuery)
-          : await queryViaCodexAppServer(options.timeoutMs, mayQuery);
+      const report = await queryViaQuotaAuth(candidate, options.timeoutMs, mayQuery);
       if (!report) return undefined;
       if (
         selectUsageSnapshot(report, CODEX_USAGE_LIMIT_ID) ||
@@ -46,33 +61,44 @@ export async function queryUsage(
         return { ok: true, report };
       }
       errors.push({
-        source,
-        message: `${source} returned no displayable codex rate-limit windows`,
+        source: candidate.source,
+        message: `${candidate.source} returned no displayable rate-limit windows`,
       });
     } catch (cause) {
-      errors.push({ source, message: errorMessage(cause), cause });
+      errors.push({ source: candidate.source, message: errorMessage(cause), cause });
     }
   }
 
+  if (!mayQuery()) return undefined;
+  try {
+    const report = await queryViaCodexAppServer(options.timeoutMs, mayQuery);
+    if (!report) return undefined;
+    if (
+      selectUsageSnapshot(report, CODEX_USAGE_LIMIT_ID) ||
+      report.credits
+    ) {
+      return { ok: true, report };
+    }
+    errors.push({
+      source: "codex-app-server",
+      message: "codex-app-server returned no displayable rate-limit windows",
+    });
+  } catch (cause) {
+    errors.push({ source: "codex-app-server", message: errorMessage(cause), cause });
+  }
+
   return { ok: false, errors };
 }
 
-async function queryViaPiAuth(
-  ctx: ExtensionContext,
+async function queryViaQuotaAuth(
+  candidate: QuotaAuthCandidate,
   timeoutMs: number,
   mayQuery: () => boolean,
 ): Promise<CodexUsageReport | undefined> {
-  const auth = await resolvePiCodexAuth(ctx);
-  if (!auth) {
-    throw new Error(
-      "No Pi OpenAI Codex subscription auth was available. Use an openai or openai-codex subscription model or run /login for OpenAI ChatGPT.",
-    );
-  }
-
   if (!mayQuery()) return undefined;
   const response = await fetchWithTimeout(
     CODEX_USAGE_URL,
-    { headers: auth.headers },
+    { headers: candidate.headers },
     timeoutMs,
   );
   const text = await response.text();
@@ -86,43 +112,93 @@ async function queryViaPiAuth(
   return normalizeBackendPayload(
     payload as RateLimitStatusPayload,
     Date.now(),
-    "pi-auth",
+    candidate.source,
   );
 }
 
-async function resolvePiCodexAuth(
-  ctx: ExtensionContext,
-): Promise<{ headers: Record<string, string> } | undefined> {
-  const models = codexAuthCandidateModels(ctx);
-  const errors: string[] = [];
+// --- Auth Candidates ---
 
-  for (const model of models) {
-    if (model.provider === "openai" && !ctx.modelRegistry.isUsingOAuth(model)) continue;
-    const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+export async function resolveQuotaAuthCandidates(
+  ctx: ExtensionContext,
+  env: NodeJS.ProcessEnv = process.env,
+  now = Date.now(),
+): Promise<QuotaAuthResolution> {
+  const candidates: QuotaAuthCandidate[] = [];
+  const errors: UsageQueryError[] = [];
+  const seenTokens = new Set<string>();
+
+  for (const model of orderedCodexAuthModels(ctx)) {
+    if (model.provider === NEW_PROVIDER && !ctx.modelRegistry.isUsingOAuth(model)) continue;
+    const source: UsageSource = model.provider === NEW_PROVIDER
+      ? "pi-auth-openai"
+      : "pi-auth-openai-codex";
+    let auth;
+    try {
+      auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+    } catch (cause) {
+      errors.push({ source, message: errorMessage(cause) });
+      continue;
+    }
     if (!auth.ok) {
-      errors.push(auth.error);
+      errors.push({ source, message: auth.error });
       continue;
     }
 
-    const headers: Record<string, string> = {};
-    for (const [name, value] of Object.entries(auth.headers ?? {})) {
-      if (value !== null) headers[name] = value;
-    }
-    if (!hasHeader(headers, "Authorization") && auth.apiKey) {
+    const headers = stringHeaders(auth.headers);
+    if (!hasHeader(headers, "Authorization") && auth.apiKey)
       headers.Authorization = `Bearer ${auth.apiKey}`;
+    const token = bearerToken(headers);
+    if (!token || token.startsWith("sk-")) continue;
+    const accountId = headerValue(headers, CODEX_USAGE_ACCOUNT_HEADER) ?? chatgptAccountId(token);
+    if (model.provider === NEW_PROVIDER && !accountId) {
+      errors.push({
+        source,
+        message: "New Pi OpenAI OAuth credential is not accepted by the Codex usage endpoint",
+      });
+      continue;
     }
-    if (!hasHeader(headers, "User-Agent")) {
-      headers["User-Agent"] = "pi-codex-usage";
+    if (isExpiredToken(token, now)) {
+      errors.push({ source, message: "Pi OpenAI subscription token has expired" });
+      continue;
     }
-    if (hasHeader(headers, "Authorization")) {
-      return { headers };
+    if (accountId && !hasHeader(headers, CODEX_USAGE_ACCOUNT_HEADER))
+      headers[CODEX_USAGE_ACCOUNT_HEADER] = accountId;
+    if (!hasHeader(headers, "User-Agent")) headers["User-Agent"] = USER_AGENT;
+    if (!hasHeader(headers, "Accept")) headers.Accept = "application/json";
+    if (seenTokens.has(token)) continue;
+    seenTokens.add(token);
+    candidates.push({ source, headers });
+  }
+
+  const codexCli = readCodexCliAuth(env, now);
+  if (codexCli) {
+    const token = bearerToken(codexCli.headers);
+    if (token && !seenTokens.has(token)) {
+      seenTokens.add(token);
+      candidates.push(codexCli);
     }
+  } else {
+    errors.push({
+      source: "codex-cli-auth",
+      message: "No usable Codex CLI ChatGPT auth was available",
+    });
   }
 
-  if (errors.length > 0) {
-    throw new Error(errors.join("; "));
+  if (candidates.length === 0 && errors.length === 0) {
+    errors.push({
+      source: "pi-auth",
+      message: "No Pi OpenAI Codex subscription auth was available. Use an openai or openai-codex subscription model or run /login for OpenAI ChatGPT.",
+    });
   }
-  return undefined;
+  return { candidates, errors };
+}
+
+function orderedCodexAuthModels(ctx: ExtensionContext): PiModel[] {
+  const models = codexAuthCandidateModels(ctx);
+  return [
+    ...models.filter((model) => model.provider === LEGACY_PROVIDER),
+    ...models.filter((model) => model.provider === NEW_PROVIDER),
+  ];
 }
 
 function codexAuthCandidateModels(ctx: ExtensionContext): PiModel[] {
@@ -142,6 +218,114 @@ function codexAuthCandidateModels(ctx: ExtensionContext): PiModel[] {
   return candidates;
 }
 
+function readCodexCliAuth(
+  env: NodeJS.ProcessEnv,
+  now: number,
+): QuotaAuthCandidate | undefined {
+  try {
+    const payload: unknown = JSON.parse(readFileSync(codexAuthPath(env), "utf8"));
+    if (!isRecord(payload)) return undefined;
+    if (typeof payload.auth_mode === "string" && payload.auth_mode !== "chatgpt")
+      return undefined;
+    const tokens = isRecord(payload.tokens) ? payload.tokens : undefined;
+    const accessToken = typeof tokens?.access_token === "string"
+      ? tokens.access_token
+      : undefined;
+    if (!accessToken || accessToken.startsWith("sk-")) return undefined;
+    if (isExpiredToken(accessToken, now)) return undefined;
+    const accountId = stringValue(tokens?.account_id)
+      ?? chatgptAccountId(accessToken)
+      ?? (typeof tokens?.id_token === "string"
+        ? chatgptAccountId(tokens.id_token)
+        : undefined);
+    if (!accountId) return undefined;
+    return {
+      source: "codex-cli-auth",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        [CODEX_USAGE_ACCOUNT_HEADER]: accountId,
+        "User-Agent": USER_AGENT,
+        Accept: "application/json",
+      },
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+function codexAuthPath(env: NodeJS.ProcessEnv): string {
+  const configured = typeof env.CODEX_HOME === "string" ? env.CODEX_HOME.trim() : "";
+  if (!configured) return join(homedir(), ".codex", "auth.json");
+  const root = configured === "~"
+    ? homedir()
+    : configured.startsWith("~/") || configured.startsWith("~\\")
+      ? join(homedir(), configured.slice(2))
+      : configured;
+  return join(root, "auth.json");
+}
+
+function stringHeaders(
+  headers: Record<string, string | null> | undefined,
+): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    if (value !== null) result[name] = value;
+  }
+  return result;
+}
+
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+  return headerValue(headers, name) !== undefined;
+}
+
+function headerValue(
+  headers: Record<string, string>,
+  name: string,
+): string | undefined {
+  const expected = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === expected && value.trim()) return value;
+  }
+  return undefined;
+}
+
+function bearerToken(headers: Record<string, string>): string | undefined {
+  const value = headerValue(headers, "Authorization");
+  return /^Bearer\s+(.+)$/iu.exec(value ?? "")?.[1]?.trim();
+}
+
+function chatgptAccountId(token: string): string | undefined {
+  const payload = decodeJwtPayload(token);
+  const authClaim = payload?.[OPENAI_AUTH_CLAIM];
+  return stringValue(isRecord(authClaim) ? authClaim.chatgpt_account_id : undefined);
+}
+
+function isExpiredToken(token: string, now: number): boolean {
+  const payload = decodeJwtPayload(token);
+  const exp = payload?.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+  return exp * 1000 <= now + TOKEN_EXPIRY_MARGIN_MS;
+}
+
+function decodeJwtPayload(token: string): Record<string, unknown> | undefined {
+  const encoded = token.split(".")[1];
+  if (!encoded) return undefined;
+  try {
+    const parsed: unknown = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    return isRecord(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function stringValue(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 async function fetchWithTimeout(
   url: string,
   init: RequestInit,
@@ -390,17 +574,12 @@ class CodexAppServerClient {
 }
 
 
-function hasHeader(headers: Record<string, string>, name: string): boolean {
-  return Object.keys(headers).some(
-    (key) => key.toLowerCase() === name.toLowerCase(),
-  );
-}
-
 function redactErrorBody(body: string): string {
   return truncateEnd(
     body
       .replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer <redacted>")
       .replace(/"access_token"\s*:\s*"[^"]+"/gi, '"access_token":"<redacted>"')
+      .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "<redacted>")
       .trim(),
     MAX_ERROR_BODY_CHARS,
   );

package/node_modules/@llblab/pi-codex-usage/lib/usage.ts

@@ -8,7 +8,12 @@ export const OPENAI_USAGE_PROVIDERS = ["openai-codex", "openai"] as const;
 export function isOpenAICodexModel(model: Pick<PiModel, "provider"> | undefined): boolean {
   return OPENAI_USAGE_PROVIDERS.some((provider) => model?.provider === provider);
 }
-export type UsageSource = "pi-auth" | "codex-app-server";
+export type UsageSource =
+  | "pi-auth"
+  | "pi-auth-openai"
+  | "pi-auth-openai-codex"
+  | "codex-cli-auth"
+  | "codex-app-server";
 export type UsageQueryError = { source: UsageSource; message: string; cause?: unknown };
 export type CodexUsageReport = {
   snapshots: NormalizedRateLimitSnapshot[];
@@ -283,6 +288,9 @@ function isUnavailableError(error: UsageQueryError): boolean {
   const message = error.message.toLowerCase();
   return (
     message.includes("no pi openai codex subscription auth") ||
+    message.includes("not accepted by the codex usage endpoint") ||
+    message.includes("no usable codex cli chatgpt auth") ||
+    message.includes("subscription token has expired") ||
     message.includes("no displayable rate-limit windows") ||
     message.includes("returned no displayable rate-limit windows") ||
     message.includes("returned 401") ||

package/node_modules/@llblab/pi-codex-usage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-codex-usage",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "private": false,
   "description": "Pi extension for Codex subscription usage and an optional Fast toggle",
   "keywords": [

package/node_modules/@llblab/pi-state-flow/AGENTS.md

@@ -13,7 +13,7 @@ The [relocation ledger](docs/agent-contract-relocation.md) maps every pre-compac
 - Artifacts name exact registered source paths; observe only regular non-symlink files, never discover directories or read unrelated bodies. Preserve hidden per-scope provenance, exact-owner compilation, stable fingerprint checks and separate Skill hashes; unavailable sources are not proof of deletion. See [artifact routing](docs/architecture.md#artifact-routing).
 - Preserve session config/runtime, per-scope metadata, lineage and provenance outside model-patchable state; decode legacy mode evidence read-only, never mix representations or normalize storage eagerly. See [storage and identity](docs/architecture.md#storage-and-identity) and [mode compatibility](docs/compatibility.md#mode-configuration-compatibility).
 - Keep one opaque composed causal lineage, anchored checkpoint/tail materialization, configured hot-history folding and independent owner revisions; never invent earlier history or rebuild discarded offsets. Historical reads are observational, and `effective[n]`/owner materializations select the same causal boundary. See [temporal model](docs/architecture.md#temporal-model) and [model tools](docs/architecture.md#model-tools).
-- Keep the [internal semantic-module contract](docs/semantic-module-contract.md) package-owned and separate from storage/native authority. Module candidates are not accepted publications; immutable means main-agent read-only, not producer-frozen. Preserve the single intent-first engine and current dialect; no runtime discovery/public ABI or automatic inference follows from a module identity.
+- Keep the [internal semantic-module contract](docs/semantic-module-contract.md) package-owned and separate from storage/native authority. Module candidates are not accepted publications; immutable means main-agent read-only, not producer-frozen. Preserve the single intent-first engine and current dialect; no runtime discovery, public registration authority or automatic inference follows from an internal module identity.
 - Keep the [public module registration boundary](docs/public-module-contract.md) native-host-scoped and revocable. A registration/catalog grants no source, private or publication authority. Follow its explicit compatibility decision before admitting external stored roots; unavailable-module data must never be dropped through filtering or normalization. Pi remains the loader.
 
 ## Publication and lifecycle