@narumitw/pi-usage 0.60.10 → 0.60.11

package/README.md

@@ -14,7 +14,7 @@ xAI OAuth subscription reporting follows the reviewed Grok Build contract and ru
 - Redeems eligible Codex resets only after fresh account matching and explicit confirmation.
 - Refreshes one or all configured providers with bounded concurrency while preserving partial results.
 - Scopes statusline and cache data to the active provider and runtime account.
-- Resolves credentials through Pi or the process-local OAuth credential-source protocol and validates the effective provider endpoint before sending them.
+- Resolves credentials through Pi or the process-local OAuth credential-source protocol, waits for compatible pending account activation, and validates the effective provider endpoint before sending them.
 
 ## 📦 Install
 
@@ -138,6 +138,7 @@ Codex reset redemption requires a freshly matched current OAuth account and expl
 The extension selects one provider target for one query and never flattens targets into provider rows or aggregates every visible target.
 Provider adapters own target discovery and validation; core owns one-target selection, persistence, cache identity, cancellation, and UI.
 A compatible credential owner may offer the verified active named account through the versioned process-local protocol without exposing its account label or storage.
+When that owner is still activating the requested provider in the current session, `/usage` waits through the extension-neutral `oauth:credential-readiness:v1` protocol before collecting the synchronous credential offer.
 Without such an owner, `pi-usage` retains its standalone Pi `auth.json` behavior.
 An older or incompatible owner degrades to the existing authentication-unavailable result when the stored login does not match runtime auth.
 After the active runtime credential changes, the next command, turn, or scheduled refresh resolves auth again and cannot reuse another account's cached report.
@@ -179,8 +180,8 @@ Behavior changes:
 
 ## 🔒 Security and privacy
 
-Credential candidates are collected synchronously in memory and are not cached, persisted, logged, formatted, or appended to the Pi session.
-The protocol carries no account name or extension identity.
+Credential candidates are collected synchronously in memory after any compatible readiness promises settle, and are not cached, persisted, logged, formatted, or appended to the Pi session.
+The protocols carry no account name or extension identity.
 Only the selected provider's exact runtime match is used, and secrets are sent only to its validated official origin.
 DeepSeek balance requests require Bearer authentication, send only that resolved credential from Pi's runtime auth to `https://api.deepseek.com/user/balance`, and refuse redirects.
 Fireworks spend requests send only that resolved credential to the official `https://api.fireworks.ai` account-listing and billing-summary endpoints and refuse redirects.

package/dist/index.ts

@@ -280,8 +280,11 @@ function truncate(value, maxChars) {
 // src/oauth-credential-source.ts
 import { readStoredCredential } from "@earendil-works/pi-coding-agent";
 var OAUTH_CREDENTIAL_SOURCE_CHANNEL = "oauth:credential-source:v1";
+var OAUTH_CREDENTIAL_READINESS_CHANNEL = "oauth:credential-readiness:v1";
 function createOAuthCredentialCandidateReader(pi, credentialReader = readStoredCredential) {
-  return (ctx, providerId) => collectOAuthCredentialCandidates(pi, ctx, providerId, credentialReader);
+  const reader = (ctx, providerId) => collectOAuthCredentialCandidates(pi, ctx, providerId, credentialReader);
+  reader.waitUntilReady = (ctx, providerId) => waitForOAuthCredentialSources(pi, ctx, providerId);
+  return reader;
 }
 function collectOAuthCredentialCandidates(pi, ctx, providerId, credentialReader = readStoredCredential) {
   const candidates = [];
@@ -310,6 +313,31 @@ function collectOAuthCredentialCandidates(pi, ctx, providerId, credentialReader
   }
   return { ok: true, candidates, offeredCount };
 }
+async function waitForOAuthCredentialSources(pi, ctx, providerId) {
+  const pending = [];
+  let collecting = true;
+  const request = Object.freeze({
+    session: ctx.sessionManager,
+    provider: providerId,
+    waitUntil(value) {
+      if (!collecting || !(value instanceof Promise)) return;
+      pending.push(value);
+    }
+  });
+  try {
+    pi.events.emit(OAUTH_CREDENTIAL_READINESS_CHANNEL, request);
+  } catch {
+    return false;
+  } finally {
+    collecting = false;
+  }
+  try {
+    await Promise.all(pending);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function fallbackOAuthCredentialCandidates(providerId, credentialReader) {
   try {
     const credential = cloneOAuthCredential(credentialReader(providerId));
@@ -2301,6 +2329,9 @@ async function resolveUsageAuth(ctx, adapter, salt = AUTH_FINGERPRINT_SALT, cred
   }
   const model = candidateModels(ctx, adapter.id).find((candidate) => hasOfficialOrigin(candidate, adapter.id));
   if (!model) return void 0;
+  if (["github-copilot", "xai"].includes(adapter.id) && candidateReader?.waitUntilReady && !await candidateReader.waitUntilReady(ctx, adapter.id)) {
+    throw new Error(`${adapter.displayName} OAuth credential readiness failed closed.`);
+  }
   const registry = ctx.modelRegistry;
   const provider = registry.getProvider?.(adapter.id);
   if (provider?.baseUrl && !hasOfficialUrlOrigin(provider.baseUrl, adapter.id)) {
@@ -2370,14 +2401,14 @@ async function resolveUsageAuth(ctx, adapter, salt = AUTH_FINGERPRINT_SALT, cred
     };
   };
   if (adapter.id === "github-copilot") {
-    const offered = candidateReader ? candidateReader(ctx, adapter.id) : fallbackOAuthCredentialCandidates(adapter.id, credentialReader);
+    const offered = candidateReader ? await candidateReader(ctx, adapter.id) : fallbackOAuthCredentialCandidates(adapter.id, credentialReader);
     if (!offered.ok) {
       throw new Error("GitHub Copilot OAuth credential discovery failed closed.");
     }
     return finalize(resolveGitHubCopilotUsageAuth(auth, model, salt, offered.candidates, offered.offeredCount === 0));
   }
   if (adapter.id === "xai") {
-    const offered = candidateReader ? candidateReader(ctx, adapter.id) : fallbackOAuthCredentialCandidates(adapter.id, credentialReader);
+    const offered = candidateReader ? await candidateReader(ctx, adapter.id) : fallbackOAuthCredentialCandidates(adapter.id, credentialReader);
     if (!offered.ok) throw new Error("xAI OAuth credential discovery failed closed.");
     return finalize(resolveXaiUsageAuth(auth, model, salt, offered.candidates));
   }
@@ -2929,19 +2960,22 @@ async function resolveCodexResetAuth(ctx, salt = AUTH_FINGERPRINT_SALT, credenti
   const expectedModel = `${model.provider}/${model.id}`;
   const adapter = adapterForProvider("openai-codex");
   if (!adapter) throw new Error("OpenAI Codex usage support is unavailable.");
+  if (candidateReader?.waitUntilReady && !await candidateReader.waitUntilReady(ctx, "openai-codex")) {
+    throw new Error("OpenAI Codex OAuth credential readiness failed closed.");
+  }
   const auth = await resolveUsageAuth(ctx, adapter, salt, credentialReader);
   if (`${ctx.model?.provider}/${ctx.model?.id}` !== expectedModel) {
     throw new Error("The current model changed while resolving Codex reset authentication.");
   }
   if (!auth) throw new Error("No runtime credential is configured for OpenAI Codex.");
+  const offered = candidateReader ? await candidateReader(ctx, "openai-codex") : fallbackOAuthCredentialCandidates("openai-codex", credentialReader);
+  if (!offered.ok) throw new Error("OpenAI Codex OAuth credential discovery failed closed.");
   const resolvedAccess = bearerToken2(headerValue2(auth.headers, "Authorization")) ?? auth.apiKey;
   if (!resolvedAccess) throw new Error("OpenAI Codex OAuth credentials were incomplete.");
   const resolvedAccountId = codexAccountIdFromAccessToken(resolvedAccess);
   if (!resolvedAccountId) {
     throw new Error("The active OpenAI Codex access token did not contain a valid account ID.");
   }
-  const offered = candidateReader ? candidateReader(ctx, "openai-codex") : fallbackOAuthCredentialCandidates("openai-codex", credentialReader);
-  if (!offered.ok) throw new Error("OpenAI Codex OAuth credential discovery failed closed.");
   const { accountId, storedAccess } = selectCodexResetCredential(
     offered.candidates,
     resolvedAccess,