@monotykamary/pi-better-openai 0.2.10 → 0.2.12

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.12
+
+- Validate against Pi 1.0.2, where `openai` supports ChatGPT subscription OAuth and `openai-codex` is labeled legacy; preserve the native OpenAI provider and transport.
+- Keep Ultrafast API-only: do not inject it for the new OpenAI subscription login, and retain Standard/Fast behavior.
+- Label separately authenticated Codex usage on OpenAI models and warn that it is not verified against the active OpenAI account.
+- Clarify that usage, banked resets, images, web search, and live voice still need `/login openai-codex`; never substitute direct-OpenAI OAuth credentials for Codex backend auth.
+- Add auth-boundary regressions and an isolated real-host subscription/API-key compatibility probe.
+
+## 0.2.11
+
+- Auto-redeem banked Codex resets ten minutes before expiry instead of one minute, with matching settings and redemption-time displays.
+- Preserve the scheduled credit across polling refreshes so the longer lead retains the no-fallback safeguard.
+- Extend the shared redemption cooldown to ten minutes and add regression coverage for exact timing and startup inside the redemption window.
+
 ## 0.2.10
 
 - Hide disabled image, web search, and decision tools and their prompt guidance, including from pi-fabric capture.

package/README.md

@@ -20,13 +20,15 @@ pi install npm:@monotykamary/pi-better-openai
 
 ## Authentication
 
-Usage display, image generation, and live voice require pi's `openai-codex` OAuth credentials.
+Pi 1.0.2 supports **Sign in with ChatGPT** under `/login openai`, using the native Responses API at `api.openai.com`. Use `openai/*` models for that subscription login or an OpenAI API key; the extension preserves pi's native authentication and transport. Standard/Fast tier overrides work with both login methods on supported models.
 
-1. In pi, run `/login openai-codex`.
-2. Verify subscription usage with `/openai-usage`, or open `/openai-settings` and check **Diagnostics**.
+Pi labels `openai-codex` **legacy**, but this extension's usage polling, banked resets, image generation, web search, and live voice still call separate `chatgpt.com/backend-api` endpoints. They require the legacy Codex login, not the new direct-OpenAI OAuth grant. Credentials are never copied or substituted between providers.
+
+1. For those backend features, also run `/login openai-codex`. You can keep an `openai/*` model selected.
+2. Inspect the Codex account's usage with `/openai-usage`, or open `/openai-settings` and check **Diagnostics**. While using `openai/*`, the footer labels it **Codex Usage**: it is not verified against your active OpenAI login and could belong to a different account. For your OpenAI subscription, check [ChatGPT usage](https://chatgpt.com/settings/usage).
 3. The extension reads auth from pi's agent auth store, normally `~/.pi/agent/auth.json`. Do not copy, paste, or commit values from this file.
 4. If `PI_CODING_AGENT_DIR` is set, the auth store, global extension config, and global generated-image directory use that agent directory instead of `~/.pi/agent`. A leading `~/` is expanded to your home directory.
-5. When [pi-multiprovider](https://github.com/monotykamary/pi-multiprovider) 0.8.0+ pools several `openai-codex` accounts, the session's active account (chosen with `/switch-account`) is resolved first for usage display, image generation, web search, and live voice; the usage widget refreshes on every switch and whenever a resumed session restores the account, so it never keeps billing the account the session used before. Without that extension, credential resolution is unchanged.
+5. When [pi-multiprovider](https://github.com/monotykamary/pi-multiprovider) 0.8.0+ pools several `openai-codex` accounts, the session's active **Codex** account (chosen with `/switch-account`) is resolved first for usage display, banked resets, image generation, web search, and live voice; the usage widget refreshes on Codex account switches and session restores. An independently selected `openai` account does not select the Codex backend account. Without that extension, credential resolution is unchanged.
 
 ## Features
 
@@ -54,9 +56,9 @@ Usage display, image generation, and live voice require pi's `openai-codex` OAut
 
 ## Banked resets
 
-Unused banked Codex resets **auto-redeem by default, 1 minute before expiry**, while an interactive pi session is running and Codex credentials are available. Starting pi within that final one-minute window also triggers the check; expired credits are skipped. This runs independently of the usage display and current model. The reset picker and confirmation show each credit's actual local auto-redemption date and time (expiry minus one minute) beside its expiry. Disable **Auto-redeem banked resets** in `/openai-settings` or set `usage.autoRedeemBankedResets` to `false` to opt out.
+Unused banked Codex resets **auto-redeem by default, 10 minutes before expiry**, while an interactive pi session is running and Codex credentials are available. Starting pi within that final ten-minute window also triggers the check; expired credits are skipped. This runs independently of the usage display and current model. The reset picker and confirmation show each credit's actual local auto-redemption date and time (expiry minus ten minutes) beside its expiry. Disable **Auto-redeem banked resets** in `/openai-settings` or set `usage.autoRedeemBankedResets` to `false` to opt out.
 
-For safety, each attempt targets one explicit, freshly checked credit ID, with no fallback to another credit and no automatic retry after a consume request (including errors or `nothing_to_reset`). A persistent per-account guard permits at most one redemption attempt in one minute across pi sessions sharing the same agent directory; manual redemption uses the same guard. Automatic reservations recheck the one-minute eligibility window while holding an exclusive filesystem lock, and attempted credit IDs remain blocked even after later redemptions or restarts. Simultaneously expiring credits are not drained, and later credits wait for their own final one-minute window. Reservations live under `$PI_CODING_AGENT_DIR/pi-better-openai/reset-redemptions` (default `~/.pi/agent/pi-better-openai/reset-redemptions`); unreadable state or an orphaned lock blocks redemption rather than risking a duplicate. Update/restart all pi instances to use the current guard. Separate machines/agent directories cannot coordinate this local guard; instances using the same account should share an agent directory.
+For safety, each attempt targets one explicit, freshly checked credit ID, with no fallback to another credit and no automatic retry after a consume request (including errors or `nothing_to_reset`). A persistent per-account guard permits at most one redemption attempt in ten minutes across pi sessions sharing the same agent directory; manual redemption uses the same guard. Automatic reservations recheck the ten-minute eligibility window while holding an exclusive filesystem lock, and attempted credit IDs remain blocked even after later redemptions or restarts. Simultaneously expiring credits are not drained, and later credits wait for their own final ten-minute window. Reservations live under `$PI_CODING_AGENT_DIR/pi-better-openai/reset-redemptions` (default `~/.pi/agent/pi-better-openai/reset-redemptions`); unreadable state or an orphaned lock blocks redemption rather than risking a duplicate. Update/restart all pi instances to use the current guard. Separate machines/agent directories cannot coordinate this local guard; instances using the same account should share an agent directory.
 
 Pi must remain running and awake; this is not an OS-level scheduled task. No eligible usage window or unavailable credentials can prevent redemption.
 
@@ -145,7 +147,7 @@ Setting `image.enabled`, `websearch.enabled`, or `decisions.enabled` to `false`
 
 `/openai-tier fast` requests `service_tier: "priority"`. `/openai-tier standard` explicitly requests `"default"`, clearing an inherited Fast/Ultrafast request tier on OpenAI providers. Legacy disabled configurations without an explicit tier leave payloads untouched. `/fast` and the `--fast` flag never select Ultrafast.
 
-`/openai-tier ultrafast` explicitly opts into **6x Standard token prices** for `openai/gpt-6-astra` over the Responses API. Only the documented global (`https://api.openai.com/v1`) and US (`https://us.api.openai.com/v1`) endpoints are enabled. EU/regional endpoints, custom proxies, other models, and Codex subscription Ultrafast are not enabled without verified support. This does not promise account entitlement or available rate limits. Unsupported selections remain requested but inactive; the extension does not inject a lower-tier fallback or retry a rejected request.
+`/openai-tier ultrafast` explicitly opts into **6x Standard token prices** for **API-key-authenticated** `openai/gpt-6-astra` over the Responses API. Only the documented global (`https://api.openai.com/v1`) and US (`https://us.api.openai.com/v1`) endpoints are enabled. EU/regional endpoints, custom proxies, other models, and ChatGPT subscription Ultrafast (both `openai` OAuth and legacy `openai-codex`) are not enabled without verified support. This does not promise account entitlement or available rate limits. Unsupported selections remain requested but inactive; the extension does not inject a lower-tier fallback or retry a rejected request.
 
 The footer shows `fast` or `ultrafast` only when supported by the current model. Diagnostics distinguish the requested tier and last injected payload from server-confirmed service or billing. **Pi's host cost estimates may omit the Ultrafast premium**; use OpenAI billing for actual charges. The host's native transport is preserved; WebSockets are recommended by OpenAI but HTTP is also supported. See [Ultrafast documentation](https://developers.openai.com/api/docs/guides/ultrafast-mode) and [pricing](https://developers.openai.com/api/docs/pricing?latest-pricing=ultrafast).
 
@@ -188,6 +190,8 @@ Example tool input:
 
 ## Codex model fallbacks
 
+These fallbacks remain scoped to the legacy provider. The native `openai` provider and its catalog are not replaced or redirected to Codex.
+
 The extension adds `gpt-6.1-sol`, `gpt-6-astra`, `gpt-daybreak-blue-latest`, and `gpt-daybreak-red-latest` to the built-in `openai-codex` provider without requiring local `models.json` entries. Existing built-in models remain available, and metadata from pi's live catalog takes precedence when pi publishes an official entry with the same ID.
 
 The GPT-6.1 Sol fallback uses Codex's conservative 272K context default, 128K output limit, and published short/long-context pricing. It maps Pi's `minimal` level to `low` and disables `off`; the model does not accept `none` or `minimal` reasoning efforts. See [model documentation](https://developers.openai.com/api/docs/models/gpt-6.1-sol) and the [upstream Codex catalog change](https://github.com/openai/codex/commit/b1e72963c3b71a9265a551e54beff078384efed9).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monotykamary/pi-better-openai",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Improve OpenAI in pi with fast mode, usage stats, realtime voice, image generation, and footer polish.",
   "keywords": [
     "fast",
@@ -65,9 +65,9 @@
     "ws": "8.21.2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "1.0.0",
-    "@earendil-works/pi-coding-agent": "1.0.0",
-    "@earendil-works/pi-tui": "1.0.0",
+    "@earendil-works/pi-ai": "1.0.2",
+    "@earendil-works/pi-coding-agent": "1.0.2",
+    "@earendil-works/pi-tui": "1.0.2",
     "@types/node": "~22.19.0",
     "@types/proxy-from-env": "1.0.4",
     "@types/ws": "8.18.1",
@@ -89,8 +89,8 @@
     "@oh-my-pi/pi-natives-win32-x64": "17.2.9"
   },
   "overrides": {
-    "@earendil-works/pi-agent-core": "1.0.0",
-    "@earendil-works/pi-ai": "1.0.0",
+    "@earendil-works/pi-agent-core": "1.0.2",
+    "@earendil-works/pi-ai": "1.0.2",
     "brace-expansion": "5.0.11",
     "nanoid": "3.3.18",
     "postcss": "8.5.25",

package/src/codex-auth.ts

@@ -6,6 +6,9 @@ import { piAgentDir } from "./paths.ts";
 
 export const AUTH_FILE = join(piAgentDir(), "auth.json");
 
+export const CODEX_AUTH_REQUIRED =
+  "Missing openai-codex OAuth credentials. Run /login openai-codex for this Codex backend feature. /login openai uses separate ChatGPT subscription credentials for api.openai.com.";
+
 export type CodexCredentials = {
   accessToken: string;
   accountId: string;
@@ -145,6 +148,8 @@ export async function getCodexCredentials(
       // Fall back to pi-owned credential resolution.
     }
   }
+  // Deliberately do not fall back to "openai": its direct ChatGPT OAuth grant
+  // targets api.openai.com, not the legacy chatgpt.com/backend-api endpoints.
   const registryRequest = ctx?.modelRegistry?.getApiKeyForProvider(CODEX_PROVIDER_ID);
   const registryToken = registryRequest
     ? await waitForSignal(

package/src/config.ts

@@ -410,7 +410,7 @@ export const USAGE_SETTING_DESCRIPTORS: readonly SettingsOptionDescriptor[] = [
     label: "Auto-redeem banked resets",
     currentValue: (cfg) => String(cfg.usage.autoRedeemBankedResets),
     values: ["true", "false"],
-    description: "Redeem one unused banked reset 1 minute before expiry while pi is running.",
+    description: "Redeem one unused banked reset 10 minutes before expiry while pi is running.",
     parse: booleanSetting,
   },
 ];

package/src/fast-controller.ts

@@ -3,7 +3,7 @@ import type { ResolvedConfig, ServiceTier, SupportedModel } from "./config.ts";
 import { isRecord } from "./config.ts";
 
 export const ULTRAFAST_NOTICE =
-  "Ultrafast uses 6x Standard token prices for API GPT-6 Astra (global/US only). Codex subscription access is not verified. Host cost estimates may exclude tier premiums.";
+  "Ultrafast uses 6x Standard token prices for API GPT-6 Astra (global/US only). ChatGPT subscription access (openai OAuth or legacy openai-codex) is not verified. Host cost estimates may exclude tier premiums.";
 
 export function currentModelKey(ctx: ExtensionContext): string {
   return ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "none";
@@ -22,7 +22,8 @@ export function supportsUltrafast(ctx: ExtensionContext): boolean {
   if (
     model?.provider !== "openai" ||
     model.id !== "gpt-6-astra" ||
-    model.api !== "openai-responses"
+    model.api !== "openai-responses" ||
+    ctx.modelRegistry.isUsingOAuth(model)
   )
     return false;
   try {

package/src/image.ts

@@ -7,6 +7,7 @@ import { Box, Container, Image, Text } from "@earendil-works/pi-tui";
 import sharp from "sharp";
 import { isRecord, normalizeImageModel, type ResolvedConfig } from "./config.ts";
 import {
+  CODEX_AUTH_REQUIRED,
   extractAccountIdFromJwt,
   getCodexCredentials,
   type CodexCredentialsWithSource,
@@ -129,7 +130,7 @@ async function getCredentials(
 ): Promise<CodexImageCredentials> {
   const credentials = await getCodexCredentials(ctx, signal);
   if (credentials) return credentials;
-  throw new Error("Missing openai-codex OAuth credentials. Run /login openai-codex.");
+  throw new Error(CODEX_AUTH_REQUIRED);
 }
 
 function resolveModel(params: Pick<ToolParams, "model">, cfg: ResolvedConfig): string {

package/src/live/transport.ts

@@ -2,7 +2,7 @@ import { HttpsProxyAgent } from "https-proxy-agent";
 import { getProxyForUrl } from "proxy-from-env";
 import { fetch as undiciFetch, ProxyAgent } from "undici";
 import WebSocket, { type RawData } from "ws";
-import type { CodexCredentials } from "../codex-auth.ts";
+import { CODEX_AUTH_REQUIRED, type CodexCredentials } from "../codex-auth.ts";
 import { generateCodexAttestation } from "./attestation.ts";
 import { loadLiveNative, type LiveNativeBindings, type LiveWebRtcPeerInstance } from "./native.ts";
 import {
@@ -186,7 +186,7 @@ export class CodexLiveTransport {
   async #signal(offer: string): Promise<LiveSignalingResult> {
     const credentials = await this.#options.getCredentials(this.#operationSignal);
     if (!credentials) {
-      throw new Error("Missing openai-codex OAuth credentials. Run /login openai-codex.");
+      throw new Error(CODEX_AUTH_REQUIRED);
     }
     const attestation = await generateCodexAttestation(this.#native);
     const headers = buildLiveHeaders(

package/src/reset-controller.ts

@@ -1,5 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { getCodexCredentials } from "./codex-auth.ts";
+import { CODEX_AUTH_REQUIRED, getCodexCredentials } from "./codex-auth.ts";
 import { sanitizeDiagnosticError } from "./format.ts";
 import { reserveBankedResetRedemption } from "./reset-guard.ts";
 import {
@@ -91,7 +91,7 @@ export class ResetController {
           this.cache = { credits, updatedAt: Date.now() };
           this.error = undefined;
         } else {
-          this.error = "OpenAI Codex credentials unavailable.";
+          this.error = CODEX_AUTH_REQUIRED;
         }
       } catch (error) {
         if (generation !== this.generation || signal.aborted) return;
@@ -130,7 +130,7 @@ export class ResetController {
       const signal = this.requestSignal(ctx);
       const credentials = await getCodexCredentials(ctx, signal);
       signal.throwIfAborted();
-      if (!credentials) throw new Error("OpenAI Codex credentials unavailable.");
+      if (!credentials) throw new Error(CODEX_AUTH_REQUIRED);
       if (!reserveBankedResetRedemption(credentials.accountId, creditId))
         throw new Error(
           "A banked reset was already attempted recently; no additional credit was spent.",
@@ -159,7 +159,7 @@ export class ResetController {
     );
   }
 
-  private scheduleAutoRedeem(): void {
+  private scheduleAutoRedeem(scheduled?: BankedResetCredit): void {
     const ctx = this.activeCtx;
     if (!ctx || this.redeeming) return;
     try {
@@ -170,7 +170,7 @@ export class ResetController {
       // A cache refresh must not replace a due timer with the next credit,
       // particularly when the scheduled one was redeemed in another client.
       if (this.autoTimer) return;
-      const credit = selectAutoRedeemCredit(this.cache?.credits.credits ?? []);
+      const credit = scheduled ?? selectAutoRedeemCredit(this.cache?.credits.credits ?? []);
       if (!credit || credit.expiresAtMs === null) return;
       const dueAt = Math.max(
         credit.expiresAtMs - BANKED_RESET_AUTO_REDEEM_LEAD_MS,
@@ -179,7 +179,9 @@ export class ResetController {
       this.autoTimer = setTimeout(
         () => {
           this.autoTimer = undefined;
-          if (Date.now() < dueAt) this.scheduleAutoRedeem();
+          // Preserve the exact credit across capped timer wakeups, even when
+          // a polling refresh has changed the cached credit list.
+          if (Date.now() < dueAt) this.scheduleAutoRedeem(credit);
           else void this.autoRedeem(ctx, credit);
         },
         Math.max(0, Math.min(dueAt - Date.now(), BANKED_RESET_CACHE_TTL_MS)),

package/src/resets.ts

@@ -7,11 +7,10 @@ export const RESET_CREDITS_URL = "https://chatgpt.com/backend-api/wham/rate-limi
 export const CONSUME_RESET_URL =
   "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume";
 
-// Auto-redeem fires in the final minute before expiry. The automatic flow
-// (credentials, a fresh credit re-check, reservation, and consume POST) shares
-// one 10s abort deadline, so a 60s lead still leaves the server tens of seconds
-// of headroom while spending the credit as late as safely possible.
-export const BANKED_RESET_AUTO_REDEEM_LEAD_MS = 60_000;
+// Auto-redeem fires ten minutes before expiry to leave more headroom than a
+// last-minute attempt. The automatic flow (credentials, a fresh credit re-check,
+// reservation, and consume POST) still shares one 10s abort deadline.
+export const BANKED_RESET_AUTO_REDEEM_LEAD_MS = 10 * 60_000;
 
 export type BankedResetStatus = "available" | "redeeming" | "redeemed" | "unknown";
 

package/src/usage-controller.ts

@@ -14,6 +14,7 @@ import {
   usageSegments,
 } from "./usage.ts";
 import { currentModelKey } from "./fast-controller.ts";
+import { CODEX_AUTH_REQUIRED } from "./codex-auth.ts";
 
 export function isOpenAISubscriptionModel(
   ctx: ExtensionContext,
@@ -77,13 +78,19 @@ export class UsageController {
     cfg = this.getConfig(ctx),
     isUsingOAuth?: boolean,
   ): UsageSegment[] | undefined {
-    return this.usageSnapshot &&
-      !this.usageError &&
-      this.usageSnapshot.scope === usageScopeForModel(ctx.model?.id) &&
-      cfg.usage.enabled &&
-      isOpenAISubscriptionModel(ctx, cfg, isUsingOAuth)
-      ? usageSegments(this.usageSnapshot, cfg.usage)
-      : undefined;
+    if (
+      !this.usageSnapshot ||
+      this.usageError ||
+      this.usageSnapshot.scope !== usageScopeForModel(ctx.model?.id) ||
+      !cfg.usage.enabled ||
+      !isOpenAISubscriptionModel(ctx, cfg, isUsingOAuth)
+    )
+      return undefined;
+    const segments = usageSegments(this.usageSnapshot, cfg.usage);
+    // The new OpenAI subscription login and the Codex backend login are independent.
+    // Never present a separately authenticated Codex account as the active OpenAI quota.
+    if (ctx.model?.provider === "openai") segments.unshift({ text: "Codex ", severity: "muted" });
+    return segments;
   }
 
   statusLine(
@@ -108,7 +115,11 @@ export class UsageController {
       this.usageUpdatedAt && Date.now() - this.usageUpdatedAt > cfg.usage.refreshIntervalMs * 2
         ? ` · stale ${formatResetCountdown((Date.now() - this.usageUpdatedAt) / 1000)}`
         : "";
-    return `${formatUsageSnapshot(this.usageSnapshot, cfg.usage)}${stale}`;
+    const source =
+      ctx.model?.provider === "openai"
+        ? "Codex account (not verified against the active OpenAI login; OpenAI usage: https://chatgpt.com/settings/usage). "
+        : "";
+    return `${source}${formatUsageSnapshot(this.usageSnapshot, cfg.usage)}${stale}`;
   }
 
   formatDebug(ctx: ExtensionContext): string {
@@ -119,6 +130,7 @@ export class UsageController {
       `Current model: ${currentModelKey(ctx)}`,
       `Current model eligible: ${isOpenAISubscriptionModel(ctx, cfg)}`,
       `Requires subscription model: ${cfg.usage.showOnlyOnSubscriptionModels}`,
+      "Credential provider: openai-codex (independent of /login openai)",
       `Auth: ${auth ? "found" : "missing"}`,
       `Account ID: ${maskIdentifier(auth?.accountId) ?? "none"}`,
       `Last fetch: ${this.usageLastFetchAt ? new Date(this.usageLastFetchAt).toLocaleTimeString() : "never"}`,
@@ -214,9 +226,7 @@ export class UsageController {
 
       this.usageSnapshot = data ? parseUsageSnapshot(data, resolvedModelId) : undefined;
       this.usageUpdatedAt = this.usageSnapshot ? Date.now() : undefined;
-      this.usageError = data
-        ? undefined
-        : `Missing openai-codex OAuth credentials in ${AUTH_FILE}.`;
+      this.usageError = data ? undefined : `${CODEX_AUTH_REQUIRED} Auth store: ${AUTH_FILE}.`;
       this.updateFooter(ctx);
       if (options?.notify)
         ctx.ui.notify(this.formatStatus(ctx), this.usageSnapshot ? "info" : "warning");

package/src/websearch.ts

@@ -6,7 +6,11 @@ import {
   type ResolvedConfig,
   type WebsearchResponseLength,
 } from "./config.ts";
-import { getCodexCredentials, type CodexCredentialsWithSource } from "./codex-auth.ts";
+import {
+  CODEX_AUTH_REQUIRED,
+  getCodexCredentials,
+  type CodexCredentialsWithSource,
+} from "./codex-auth.ts";
 import { maskIdentifier, sanitizeDiagnosticError } from "./format.ts";
 import { registerOptionalTool, type OptionalTool } from "./optional-tool.ts";
 
@@ -90,10 +94,7 @@ async function getCredentials(
 ): Promise<CodexCredentialsWithSource> {
   const credentials = await getCodexCredentials(ctx, signal);
   if (credentials) return credentials;
-  throw new WebSearchError(
-    "authentication_required",
-    "Missing openai-codex OAuth credentials. Run /login openai-codex.",
-  );
+  throw new WebSearchError("authentication_required", CODEX_AUTH_REQUIRED);
 }
 
 export function validateSearchQuery(query: string): string {