@oh-my-pi/pi-ai 18.2.1 → 18.2.2

package/src/usage/openai-codex.ts

@@ -43,10 +43,23 @@ interface CodexUsageAdditionalRateLimitPayload {
 	rate_limit?: CodexUsageRateLimitPayload | null;
 }
 
+interface CodexUsageCreditsPayload {
+	has_credits?: boolean;
+	unlimited?: boolean;
+	overage_limit_reached?: boolean;
+	balance?: string | number;
+}
+
+interface CodexUsageSpendControlPayload {
+	reached?: boolean;
+}
+
 interface CodexUsagePayload {
 	plan_type?: string;
 	rate_limit?: CodexUsageRateLimitPayload | null;
 	additional_rate_limits?: CodexUsageAdditionalRateLimitPayload[] | null;
+	credits?: CodexUsageCreditsPayload | null;
+	spend_control?: CodexUsageSpendControlPayload | null;
 }
 
 interface ParsedUsageWindow {
@@ -72,6 +85,13 @@ interface ParsedUsage {
 	primary?: ParsedUsageWindow;
 	secondary?: ParsedUsageWindow;
 	additional: ParsedAdditionalUsage[];
+	/**
+	 * True when the account can still serve requests on credits after its plan
+	 * windows report `limit_reached`. `/wham/usage` only describes the *plan*
+	 * allowance, so without this a credit-funded account looks permanently
+	 * exhausted until the weekly reset while `/responses` keeps accepting it.
+	 */
+	creditOverage: boolean;
 	raw: CodexUsagePayload;
 }
 
@@ -161,6 +181,28 @@ function parseAdditionalRateLimit(payload: unknown): ParsedAdditionalUsage | nul
 	return { limitName, meteredFeature, allowed, limitReached, primary, secondary };
 }
 
+/**
+ * True when paid credits can still fund plan-window overage. Codex CLI never
+ * gates on `/wham/usage`, so once the plan allowance is spent it keeps working
+ * off this balance; omp must mirror that or it parks a perfectly usable account
+ * until the weekly reset.
+ *
+ * Scoped to the plan verdict on purpose. `credits` describes the account's
+ * overage funding for the plan windows, and nothing in the payload says a
+ * balance covers a separate metered feature (Spark, reserve). A denial that is
+ * not plan exhaustion is left alone for the same reason: credits answer
+ * "allowance spent", not "request refused".
+ */
+function hasPlanCreditOverage(payload: Record<string, unknown>, planLimitReached: boolean | undefined): boolean {
+	if (planLimitReached !== true) return false;
+	const credits = isRecord(payload.credits) ? payload.credits : undefined;
+	if (!credits) return false;
+	if (credits.unlimited !== true && credits.has_credits !== true) return false;
+	if (credits.overage_limit_reached === true) return false;
+	const spendControl = isRecord(payload.spend_control) ? payload.spend_control : undefined;
+	return spendControl?.reached !== true;
+}
+
 function parseUsagePayload(payload: unknown): ParsedUsage | null {
 	if (!isRecord(payload)) return null;
 	const planType = typeof payload.plan_type === "string" ? payload.plan_type : undefined;
@@ -170,13 +212,15 @@ function parseUsagePayload(payload: unknown): ParsedUsage | null {
 		.map(parseAdditionalRateLimit)
 		.filter((value): value is ParsedAdditionalUsage => value !== null);
 	if (!rateLimit && additional.length === 0) return null;
+	const planLimitReached = rateLimit ? toBoolean(rateLimit.limit_reached) : undefined;
 	const parsed: ParsedUsage = {
 		planType,
 		allowed: rateLimit ? toBoolean(rateLimit.allowed) : undefined,
-		limitReached: rateLimit ? toBoolean(rateLimit.limit_reached) : undefined,
+		limitReached: planLimitReached,
 		primary: rateLimit ? parseUsageWindow(rateLimit.primary_window) : undefined,
 		secondary: rateLimit ? parseUsageWindow(rateLimit.secondary_window) : undefined,
 		additional,
+		creditOverage: hasPlanCreditOverage(payload, planLimitReached),
 		raw: payload as CodexUsagePayload,
 	};
 	if (
@@ -273,6 +317,17 @@ function buildUsageStatus(args: { usedFraction?: number; explicitlyAllowed: bool
 	return "ok";
 }
 
+/**
+ * Whether Codex will still serve this meter: an explicit positive verdict, or
+ * credits covering overage of a spent plan window. The credit override needs
+ * `limitReached === true`; a refusal for any other reason is not something a
+ * balance can pay for.
+ */
+function isCodexRequestAllowed(args: { allowed?: boolean; limitReached?: boolean; creditOverage?: boolean }): boolean {
+	if (args.creditOverage === true && args.limitReached === true) return true;
+	return args.allowed === true && args.limitReached === false;
+}
+
 function buildUsageLimit(args: {
 	key: "primary" | "secondary";
 	window: ParsedUsageWindow;
@@ -280,6 +335,7 @@ function buildUsageLimit(args: {
 	planType?: string;
 	allowed?: boolean;
 	limitReached?: boolean;
+	creditOverage?: boolean;
 	nowMs: number;
 }): UsageLimit {
 	const usageWindow = buildUsageWindow(args.window, args.key, args.nowMs);
@@ -296,11 +352,12 @@ function buildUsageLimit(args: {
 		amount,
 		// The shared account-level rejection flag cannot identify which window
 		// is binding, but an explicit positive verdict applies to both windows.
-		// Preserve 100% as a warning when Codex still allows requests; live
-		// usage_limit_reached responses remain authoritative for blocking.
+		// Preserve 100% as a warning when Codex still allows requests — either
+		// explicitly, or because credits fund overage past the plan window.
+		// Live usage_limit_reached responses remain authoritative for blocking.
 		status: buildUsageStatus({
 			usedFraction: amount.usedFraction,
-			explicitlyAllowed: args.allowed === true && args.limitReached === false,
+			explicitlyAllowed: isCodexRequestAllowed(args),
 		}),
 	};
 }
@@ -354,9 +411,11 @@ function buildAdditionalUsageLimit(args: {
 		amount,
 		// A positive meter verdict is authoritative even when the advisory
 		// percentage rounds to 100; negative shared verdicts remain window-local.
+		// Plan credits are deliberately not passed here: this meter is a separate
+		// allowance, and nothing in the payload says a balance funds its overage.
 		status: buildUsageStatus({
 			usedFraction: amount.usedFraction,
-			explicitlyAllowed: args.allowed === true && args.limitReached === false,
+			explicitlyAllowed: isCodexRequestAllowed(args),
 		}),
 	};
 }
@@ -367,7 +426,11 @@ function buildAdditionalUsageLimit(args: {
  * ingesting them lets credential selection block an exhausted account before
  * the next request burns a wire 429.
  */
-export function parseCodexRateLimitHeaders(headers: Record<string, string>, now = Date.now()): UsageReport | null {
+export function parseCodexRateLimitHeaders(
+	headers: Record<string, string>,
+	now = Date.now(),
+	context?: { responseStatus?: number },
+): UsageReport | null {
 	const parseWindow = (key: "primary" | "secondary"): ParsedUsageWindow | undefined => {
 		const usedPercent = toNumber(headers[`x-codex-${key}-used-percent`]);
 		if (usedPercent === undefined) return undefined;
@@ -383,8 +446,11 @@ export function parseCodexRateLimitHeaders(headers: Record<string, string>, now
 	const secondary = parseWindow("secondary");
 	if (!primary && !secondary) return null;
 	const limits: UsageLimit[] = [];
-	if (primary) limits.push(buildUsageLimit({ key: "primary", window: primary, nowMs: now }));
-	if (secondary) limits.push(buildUsageLimit({ key: "secondary", window: secondary, nowMs: now }));
+	const requestSucceeded =
+		context?.responseStatus !== undefined && context.responseStatus >= 200 && context.responseStatus < 300;
+	const verdict = requestSucceeded ? { allowed: true, limitReached: false } : {};
+	if (primary) limits.push(buildUsageLimit({ key: "primary", window: primary, ...verdict, nowMs: now }));
+	if (secondary) limits.push(buildUsageLimit({ key: "secondary", window: secondary, ...verdict, nowMs: now }));
 	return {
 		provider: "openai-codex",
 		fetchedAt: now,
@@ -393,6 +459,21 @@ export function parseCodexRateLimitHeaders(headers: Record<string, string>, now
 	};
 }
 
+/**
+ * Plan meter verdict as credential selection should see it. Credits funding
+ * overage flip a plan-level rejection back to serving, which is what lets a
+ * stale usage-limit block self-heal instead of parking the account until reset.
+ * Only the plan meter takes this override — {@link hasPlanCreditOverage}.
+ */
+function buildPlanMeterState(
+	allowed: boolean | undefined,
+	limitReached: boolean | undefined,
+	creditOverage: boolean,
+): { allowed?: boolean; limitReached?: boolean } {
+	if (!creditOverage) return { allowed, limitReached };
+	return { allowed: true, limitReached: false };
+}
+
 export const openaiCodexUsageProvider: UsageProvider = {
 	id: "openai-codex",
 	supports(params: UsageFetchParams): boolean {
@@ -444,9 +525,10 @@ export const openaiCodexUsageProvider: UsageProvider = {
 			parsed?.planType ??
 			(isRecord(payload) && typeof payload.plan_type === "string" ? payload.plan_type : undefined);
 
+		const creditOverage = parsed?.creditOverage === true;
 		const limits: UsageLimit[] = [];
 		const meterStates: Record<string, { allowed?: boolean; limitReached?: boolean }> = {
-			chat: { allowed: parsed?.allowed, limitReached: parsed?.limitReached },
+			chat: buildPlanMeterState(parsed?.allowed, parsed?.limitReached, creditOverage),
 		};
 		if (parsed?.primary) {
 			limits.push(
@@ -457,6 +539,7 @@ export const openaiCodexUsageProvider: UsageProvider = {
 					planType,
 					allowed: parsed.allowed,
 					limitReached: parsed.limitReached,
+					creditOverage,
 					nowMs,
 				}),
 			);
@@ -470,6 +553,7 @@ export const openaiCodexUsageProvider: UsageProvider = {
 					planType,
 					allowed: parsed.allowed,
 					limitReached: parsed.limitReached,
+					creditOverage,
 					nowMs,
 				}),
 			);
@@ -548,8 +632,7 @@ export const openaiCodexUsageProvider: UsageProvider = {
 			...(resetCredits ? { resetCredits } : {}),
 			metadata: {
 				planType,
-				allowed: parsed?.allowed,
-				limitReached: parsed?.limitReached,
+				...buildPlanMeterState(parsed?.allowed, parsed?.limitReached, creditOverage),
 				email,
 				accountId,
 				meterStates,

package/src/usage.ts

@@ -356,7 +356,11 @@ export interface UsageProvider {
 	id: Provider;
 	fetchUsage(params: UsageFetchParams, ctx: UsageFetchContext): Promise<UsageReport | null>;
 	/** Parse provider rate-limit response headers (lowercased keys) into a usage report, if supported. */
-	parseRateLimitHeaders?(headers: Record<string, string>, now?: number): UsageReport | null;
+	parseRateLimitHeaders?(
+		headers: Record<string, string>,
+		now?: number,
+		context?: { responseStatus?: number },
+	): UsageReport | null;
 	supports?(params: UsageFetchParams): boolean;
 	/** True when fetchUsage contacts upstream and can authenticate the credential for health checks. */
 	validatesCredentials?: boolean;

package/src/utils/http-inspector.ts

@@ -165,10 +165,30 @@ export function rewriteClinePassError(errorMessage: string, provider: string): s
 function sanitizeDump(dump: RawHttpRequestDump): RawHttpRequestDump {
 	return {
 		...dump,
+		url: redactUrlQuery(dump.url),
 		headers: redactHeaders(dump.headers),
 	};
 }
 
+/**
+ * Strips a persisted dump's query string entirely rather than picking sensitive
+ * params by name: a configurable `baseUrl` (e.g. Bedrock's gateway routing) can
+ * carry an arbitrary query-based credential the way `SENSITIVE_HEADER_PATTERN`
+ * matches arbitrary header names, and dumps exist to diagnose the request body,
+ * not the query.
+ */
+function redactUrlQuery(url: string | undefined): string | undefined {
+	if (!url) return url;
+	try {
+		const parsed = new URL(url);
+		if (!parsed.search) return url;
+		parsed.search = "";
+		return `${parsed.toString()}[redacted-query]`;
+	} catch {
+		return url;
+	}
+}
+
 function redactHeaders(headers: Record<string, string> | undefined): Record<string, string> | undefined {
 	if (!headers) {
 		return undefined;