@monotykamary/pi-better-openai 0.2.11 → 0.2.12

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.12
+
+- Validate against Pi 1.0.2, where `openai` supports ChatGPT subscription OAuth and `openai-codex` is labeled legacy; preserve the native OpenAI provider and transport.
+- Keep Ultrafast API-only: do not inject it for the new OpenAI subscription login, and retain Standard/Fast behavior.
+- Label separately authenticated Codex usage on OpenAI models and warn that it is not verified against the active OpenAI account.
+- Clarify that usage, banked resets, images, web search, and live voice still need `/login openai-codex`; never substitute direct-OpenAI OAuth credentials for Codex backend auth.
+- Add auth-boundary regressions and an isolated real-host subscription/API-key compatibility probe.
+
 ## 0.2.11
 
 - Auto-redeem banked Codex resets ten minutes before expiry instead of one minute, with matching settings and redemption-time displays.

package/README.md

@@ -20,13 +20,15 @@ pi install npm:@monotykamary/pi-better-openai
 
 ## Authentication
 
-Usage display, image generation, and live voice require pi's `openai-codex` OAuth credentials.
+Pi 1.0.2 supports **Sign in with ChatGPT** under `/login openai`, using the native Responses API at `api.openai.com`. Use `openai/*` models for that subscription login or an OpenAI API key; the extension preserves pi's native authentication and transport. Standard/Fast tier overrides work with both login methods on supported models.
 
-1. In pi, run `/login openai-codex`.
-2. Verify subscription usage with `/openai-usage`, or open `/openai-settings` and check **Diagnostics**.
+Pi labels `openai-codex` **legacy**, but this extension's usage polling, banked resets, image generation, web search, and live voice still call separate `chatgpt.com/backend-api` endpoints. They require the legacy Codex login, not the new direct-OpenAI OAuth grant. Credentials are never copied or substituted between providers.
+
+1. For those backend features, also run `/login openai-codex`. You can keep an `openai/*` model selected.
+2. Inspect the Codex account's usage with `/openai-usage`, or open `/openai-settings` and check **Diagnostics**. While using `openai/*`, the footer labels it **Codex Usage**: it is not verified against your active OpenAI login and could belong to a different account. For your OpenAI subscription, check [ChatGPT usage](https://chatgpt.com/settings/usage).
 3. The extension reads auth from pi's agent auth store, normally `~/.pi/agent/auth.json`. Do not copy, paste, or commit values from this file.
 4. If `PI_CODING_AGENT_DIR` is set, the auth store, global extension config, and global generated-image directory use that agent directory instead of `~/.pi/agent`. A leading `~/` is expanded to your home directory.
-5. When [pi-multiprovider](https://github.com/monotykamary/pi-multiprovider) 0.8.0+ pools several `openai-codex` accounts, the session's active account (chosen with `/switch-account`) is resolved first for usage display, image generation, web search, and live voice; the usage widget refreshes on every switch and whenever a resumed session restores the account, so it never keeps billing the account the session used before. Without that extension, credential resolution is unchanged.
+5. When [pi-multiprovider](https://github.com/monotykamary/pi-multiprovider) 0.8.0+ pools several `openai-codex` accounts, the session's active **Codex** account (chosen with `/switch-account`) is resolved first for usage display, banked resets, image generation, web search, and live voice; the usage widget refreshes on Codex account switches and session restores. An independently selected `openai` account does not select the Codex backend account. Without that extension, credential resolution is unchanged.
 
 ## Features
 
@@ -145,7 +147,7 @@ Setting `image.enabled`, `websearch.enabled`, or `decisions.enabled` to `false`
 
 `/openai-tier fast` requests `service_tier: "priority"`. `/openai-tier standard` explicitly requests `"default"`, clearing an inherited Fast/Ultrafast request tier on OpenAI providers. Legacy disabled configurations without an explicit tier leave payloads untouched. `/fast` and the `--fast` flag never select Ultrafast.
 
-`/openai-tier ultrafast` explicitly opts into **6x Standard token prices** for `openai/gpt-6-astra` over the Responses API. Only the documented global (`https://api.openai.com/v1`) and US (`https://us.api.openai.com/v1`) endpoints are enabled. EU/regional endpoints, custom proxies, other models, and Codex subscription Ultrafast are not enabled without verified support. This does not promise account entitlement or available rate limits. Unsupported selections remain requested but inactive; the extension does not inject a lower-tier fallback or retry a rejected request.
+`/openai-tier ultrafast` explicitly opts into **6x Standard token prices** for **API-key-authenticated** `openai/gpt-6-astra` over the Responses API. Only the documented global (`https://api.openai.com/v1`) and US (`https://us.api.openai.com/v1`) endpoints are enabled. EU/regional endpoints, custom proxies, other models, and ChatGPT subscription Ultrafast (both `openai` OAuth and legacy `openai-codex`) are not enabled without verified support. This does not promise account entitlement or available rate limits. Unsupported selections remain requested but inactive; the extension does not inject a lower-tier fallback or retry a rejected request.
 
 The footer shows `fast` or `ultrafast` only when supported by the current model. Diagnostics distinguish the requested tier and last injected payload from server-confirmed service or billing. **Pi's host cost estimates may omit the Ultrafast premium**; use OpenAI billing for actual charges. The host's native transport is preserved; WebSockets are recommended by OpenAI but HTTP is also supported. See [Ultrafast documentation](https://developers.openai.com/api/docs/guides/ultrafast-mode) and [pricing](https://developers.openai.com/api/docs/pricing?latest-pricing=ultrafast).
 
@@ -188,6 +190,8 @@ Example tool input:
 
 ## Codex model fallbacks
 
+These fallbacks remain scoped to the legacy provider. The native `openai` provider and its catalog are not replaced or redirected to Codex.
+
 The extension adds `gpt-6.1-sol`, `gpt-6-astra`, `gpt-daybreak-blue-latest`, and `gpt-daybreak-red-latest` to the built-in `openai-codex` provider without requiring local `models.json` entries. Existing built-in models remain available, and metadata from pi's live catalog takes precedence when pi publishes an official entry with the same ID.
 
 The GPT-6.1 Sol fallback uses Codex's conservative 272K context default, 128K output limit, and published short/long-context pricing. It maps Pi's `minimal` level to `low` and disables `off`; the model does not accept `none` or `minimal` reasoning efforts. See [model documentation](https://developers.openai.com/api/docs/models/gpt-6.1-sol) and the [upstream Codex catalog change](https://github.com/openai/codex/commit/b1e72963c3b71a9265a551e54beff078384efed9).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monotykamary/pi-better-openai",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Improve OpenAI in pi with fast mode, usage stats, realtime voice, image generation, and footer polish.",
   "keywords": [
     "fast",
@@ -65,9 +65,9 @@
     "ws": "8.21.2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "1.0.0",
-    "@earendil-works/pi-coding-agent": "1.0.0",
-    "@earendil-works/pi-tui": "1.0.0",
+    "@earendil-works/pi-ai": "1.0.2",
+    "@earendil-works/pi-coding-agent": "1.0.2",
+    "@earendil-works/pi-tui": "1.0.2",
     "@types/node": "~22.19.0",
     "@types/proxy-from-env": "1.0.4",
     "@types/ws": "8.18.1",
@@ -89,8 +89,8 @@
     "@oh-my-pi/pi-natives-win32-x64": "17.2.9"
   },
   "overrides": {
-    "@earendil-works/pi-agent-core": "1.0.0",
-    "@earendil-works/pi-ai": "1.0.0",
+    "@earendil-works/pi-agent-core": "1.0.2",
+    "@earendil-works/pi-ai": "1.0.2",
     "brace-expansion": "5.0.11",
     "nanoid": "3.3.18",
     "postcss": "8.5.25",

package/src/codex-auth.ts

@@ -6,6 +6,9 @@ import { piAgentDir } from "./paths.ts";
 
 export const AUTH_FILE = join(piAgentDir(), "auth.json");
 
+export const CODEX_AUTH_REQUIRED =
+  "Missing openai-codex OAuth credentials. Run /login openai-codex for this Codex backend feature. /login openai uses separate ChatGPT subscription credentials for api.openai.com.";
+
 export type CodexCredentials = {
   accessToken: string;
   accountId: string;
@@ -145,6 +148,8 @@ export async function getCodexCredentials(
       // Fall back to pi-owned credential resolution.
     }
   }
+  // Deliberately do not fall back to "openai": its direct ChatGPT OAuth grant
+  // targets api.openai.com, not the legacy chatgpt.com/backend-api endpoints.
   const registryRequest = ctx?.modelRegistry?.getApiKeyForProvider(CODEX_PROVIDER_ID);
   const registryToken = registryRequest
     ? await waitForSignal(

package/src/fast-controller.ts

@@ -3,7 +3,7 @@ import type { ResolvedConfig, ServiceTier, SupportedModel } from "./config.ts";
 import { isRecord } from "./config.ts";
 
 export const ULTRAFAST_NOTICE =
-  "Ultrafast uses 6x Standard token prices for API GPT-6 Astra (global/US only). Codex subscription access is not verified. Host cost estimates may exclude tier premiums.";
+  "Ultrafast uses 6x Standard token prices for API GPT-6 Astra (global/US only). ChatGPT subscription access (openai OAuth or legacy openai-codex) is not verified. Host cost estimates may exclude tier premiums.";
 
 export function currentModelKey(ctx: ExtensionContext): string {
   return ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "none";
@@ -22,7 +22,8 @@ export function supportsUltrafast(ctx: ExtensionContext): boolean {
   if (
     model?.provider !== "openai" ||
     model.id !== "gpt-6-astra" ||
-    model.api !== "openai-responses"
+    model.api !== "openai-responses" ||
+    ctx.modelRegistry.isUsingOAuth(model)
   )
     return false;
   try {

package/src/image.ts

@@ -7,6 +7,7 @@ import { Box, Container, Image, Text } from "@earendil-works/pi-tui";
 import sharp from "sharp";
 import { isRecord, normalizeImageModel, type ResolvedConfig } from "./config.ts";
 import {
+  CODEX_AUTH_REQUIRED,
   extractAccountIdFromJwt,
   getCodexCredentials,
   type CodexCredentialsWithSource,
@@ -129,7 +130,7 @@ async function getCredentials(
 ): Promise<CodexImageCredentials> {
   const credentials = await getCodexCredentials(ctx, signal);
   if (credentials) return credentials;
-  throw new Error("Missing openai-codex OAuth credentials. Run /login openai-codex.");
+  throw new Error(CODEX_AUTH_REQUIRED);
 }
 
 function resolveModel(params: Pick<ToolParams, "model">, cfg: ResolvedConfig): string {

package/src/live/transport.ts

@@ -2,7 +2,7 @@ import { HttpsProxyAgent } from "https-proxy-agent";
 import { getProxyForUrl } from "proxy-from-env";
 import { fetch as undiciFetch, ProxyAgent } from "undici";
 import WebSocket, { type RawData } from "ws";
-import type { CodexCredentials } from "../codex-auth.ts";
+import { CODEX_AUTH_REQUIRED, type CodexCredentials } from "../codex-auth.ts";
 import { generateCodexAttestation } from "./attestation.ts";
 import { loadLiveNative, type LiveNativeBindings, type LiveWebRtcPeerInstance } from "./native.ts";
 import {
@@ -186,7 +186,7 @@ export class CodexLiveTransport {
   async #signal(offer: string): Promise<LiveSignalingResult> {
     const credentials = await this.#options.getCredentials(this.#operationSignal);
     if (!credentials) {
-      throw new Error("Missing openai-codex OAuth credentials. Run /login openai-codex.");
+      throw new Error(CODEX_AUTH_REQUIRED);
     }
     const attestation = await generateCodexAttestation(this.#native);
     const headers = buildLiveHeaders(

package/src/reset-controller.ts

@@ -1,5 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { getCodexCredentials } from "./codex-auth.ts";
+import { CODEX_AUTH_REQUIRED, getCodexCredentials } from "./codex-auth.ts";
 import { sanitizeDiagnosticError } from "./format.ts";
 import { reserveBankedResetRedemption } from "./reset-guard.ts";
 import {
@@ -91,7 +91,7 @@ export class ResetController {
           this.cache = { credits, updatedAt: Date.now() };
           this.error = undefined;
         } else {
-          this.error = "OpenAI Codex credentials unavailable.";
+          this.error = CODEX_AUTH_REQUIRED;
         }
       } catch (error) {
         if (generation !== this.generation || signal.aborted) return;
@@ -130,7 +130,7 @@ export class ResetController {
       const signal = this.requestSignal(ctx);
       const credentials = await getCodexCredentials(ctx, signal);
       signal.throwIfAborted();
-      if (!credentials) throw new Error("OpenAI Codex credentials unavailable.");
+      if (!credentials) throw new Error(CODEX_AUTH_REQUIRED);
       if (!reserveBankedResetRedemption(credentials.accountId, creditId))
         throw new Error(
           "A banked reset was already attempted recently; no additional credit was spent.",

package/src/usage-controller.ts

@@ -14,6 +14,7 @@ import {
   usageSegments,
 } from "./usage.ts";
 import { currentModelKey } from "./fast-controller.ts";
+import { CODEX_AUTH_REQUIRED } from "./codex-auth.ts";
 
 export function isOpenAISubscriptionModel(
   ctx: ExtensionContext,
@@ -77,13 +78,19 @@ export class UsageController {
     cfg = this.getConfig(ctx),
     isUsingOAuth?: boolean,
   ): UsageSegment[] | undefined {
-    return this.usageSnapshot &&
-      !this.usageError &&
-      this.usageSnapshot.scope === usageScopeForModel(ctx.model?.id) &&
-      cfg.usage.enabled &&
-      isOpenAISubscriptionModel(ctx, cfg, isUsingOAuth)
-      ? usageSegments(this.usageSnapshot, cfg.usage)
-      : undefined;
+    if (
+      !this.usageSnapshot ||
+      this.usageError ||
+      this.usageSnapshot.scope !== usageScopeForModel(ctx.model?.id) ||
+      !cfg.usage.enabled ||
+      !isOpenAISubscriptionModel(ctx, cfg, isUsingOAuth)
+    )
+      return undefined;
+    const segments = usageSegments(this.usageSnapshot, cfg.usage);
+    // The new OpenAI subscription login and the Codex backend login are independent.
+    // Never present a separately authenticated Codex account as the active OpenAI quota.
+    if (ctx.model?.provider === "openai") segments.unshift({ text: "Codex ", severity: "muted" });
+    return segments;
   }
 
   statusLine(
@@ -108,7 +115,11 @@ export class UsageController {
       this.usageUpdatedAt && Date.now() - this.usageUpdatedAt > cfg.usage.refreshIntervalMs * 2
         ? ` · stale ${formatResetCountdown((Date.now() - this.usageUpdatedAt) / 1000)}`
         : "";
-    return `${formatUsageSnapshot(this.usageSnapshot, cfg.usage)}${stale}`;
+    const source =
+      ctx.model?.provider === "openai"
+        ? "Codex account (not verified against the active OpenAI login; OpenAI usage: https://chatgpt.com/settings/usage). "
+        : "";
+    return `${source}${formatUsageSnapshot(this.usageSnapshot, cfg.usage)}${stale}`;
   }
 
   formatDebug(ctx: ExtensionContext): string {
@@ -119,6 +130,7 @@ export class UsageController {
       `Current model: ${currentModelKey(ctx)}`,
       `Current model eligible: ${isOpenAISubscriptionModel(ctx, cfg)}`,
       `Requires subscription model: ${cfg.usage.showOnlyOnSubscriptionModels}`,
+      "Credential provider: openai-codex (independent of /login openai)",
       `Auth: ${auth ? "found" : "missing"}`,
       `Account ID: ${maskIdentifier(auth?.accountId) ?? "none"}`,
       `Last fetch: ${this.usageLastFetchAt ? new Date(this.usageLastFetchAt).toLocaleTimeString() : "never"}`,
@@ -214,9 +226,7 @@ export class UsageController {
 
       this.usageSnapshot = data ? parseUsageSnapshot(data, resolvedModelId) : undefined;
       this.usageUpdatedAt = this.usageSnapshot ? Date.now() : undefined;
-      this.usageError = data
-        ? undefined
-        : `Missing openai-codex OAuth credentials in ${AUTH_FILE}.`;
+      this.usageError = data ? undefined : `${CODEX_AUTH_REQUIRED} Auth store: ${AUTH_FILE}.`;
       this.updateFooter(ctx);
       if (options?.notify)
         ctx.ui.notify(this.formatStatus(ctx), this.usageSnapshot ? "info" : "warning");

package/src/websearch.ts

@@ -6,7 +6,11 @@ import {
   type ResolvedConfig,
   type WebsearchResponseLength,
 } from "./config.ts";
-import { getCodexCredentials, type CodexCredentialsWithSource } from "./codex-auth.ts";
+import {
+  CODEX_AUTH_REQUIRED,
+  getCodexCredentials,
+  type CodexCredentialsWithSource,
+} from "./codex-auth.ts";
 import { maskIdentifier, sanitizeDiagnosticError } from "./format.ts";
 import { registerOptionalTool, type OptionalTool } from "./optional-tool.ts";
 
@@ -90,10 +94,7 @@ async function getCredentials(
 ): Promise<CodexCredentialsWithSource> {
   const credentials = await getCodexCredentials(ctx, signal);
   if (credentials) return credentials;
-  throw new WebSearchError(
-    "authentication_required",
-    "Missing openai-codex OAuth credentials. Run /login openai-codex.",
-  );
+  throw new WebSearchError("authentication_required", CODEX_AUTH_REQUIRED);
 }
 
 export function validateSearchQuery(query: string): string {