@scrylog/cli 0.1.4 → 0.3.0

package/src/usage/clients/opencode-go-usage.ts

@@ -1,7 +1,14 @@
 import type { UsageClient } from "../client";
 import type { OpenCodeGoUsageSnapshot } from "../types";
-import { InvalidCredentialsError } from "../clients/anthropic-web-usage";
-import { ParseError } from "../clients/anthropic-oauth-usage";
+import { classifyUsageError, UsageError } from "../errors";
+
+const AUTH_COOKIE_NAMES = new Set(["auth", "__Host-auth", "__Host-console_session"]);
+
+export interface OpenCodeGoClientCredentials {
+  cookies: string;
+  serverFnId: string;
+  onCookieRotation?: (cookies: string) => void;
+}
 
 function randomUuid(): string {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
@@ -13,8 +20,112 @@ function randomUuid(): string {
 
 function isSignedOut(text: string): boolean {
   const lower = text.toLowerCase();
-  const indicators = ["login", "sign in", "auth/authorize", "not associated with an account", 'actor of type "public"'];
-  return indicators.some((ind) => lower.includes(ind.toLowerCase()));
+  return (
+    lower.includes("auth/authorize") ||
+    lower.includes("not associated with an account") ||
+    lower.includes('actor of type "public"') ||
+    /(?:href|action)=["'][^"']*\/(?:login|signin)(?:[?"'])/.test(lower)
+  );
+}
+
+function parseCookieHeader(header: string): Map<string, string> {
+  const cookies = new Map<string, string>();
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 1) continue;
+    const name = part.slice(0, separator).trim();
+    if (AUTH_COOKIE_NAMES.has(name)) cookies.set(name, part.slice(separator + 1).trim());
+  }
+  return cookies;
+}
+
+function buildAuthCookieHeader(cookies: ReadonlyMap<string, string>): string {
+  return [...cookies].map(([name, value]) => `${name}=${value}`).join("; ");
+}
+
+function getSetCookieHeaders(headers: Headers): string[] {
+  const values = (headers as Headers & { getSetCookie?: () => string[] }).getSetCookie?.();
+  if (values?.length) return values;
+  const combined = headers.get("set-cookie");
+  return combined ? combined.split(/,\s*(?=(?:auth|__Host-auth)=)/) : [];
+}
+
+function applyAuthCookieRotation(current: string, headers: Headers): string {
+  const cookies = parseCookieHeader(current);
+  for (const setCookie of getSetCookieHeaders(headers)) {
+    const [pair, ...attributes] = setCookie.split(";");
+    const separator = pair!.indexOf("=");
+    if (separator < 1) continue;
+    const name = pair!.slice(0, separator).trim();
+    if (!AUTH_COOKIE_NAMES.has(name)) continue;
+
+    const value = pair!.slice(separator + 1).trim();
+    const expired = attributes.some((attribute) => {
+      const [rawName, rawValue = ""] = attribute.trim().split("=", 2);
+      const attributeName = rawName!.toLowerCase();
+      if (attributeName === "max-age") return Number(rawValue) <= 0;
+      if (attributeName !== "expires") return false;
+      const expiresAt = Date.parse(rawValue);
+      return !Number.isNaN(expiresAt) && expiresAt <= Date.now();
+    });
+    if (!value || expired) cookies.delete(name);
+    else cookies.set(name, value);
+  }
+  return buildAuthCookieHeader(cookies);
+}
+
+function retryAfterMs(response: Response): number | undefined {
+  const value = response.headers.get("retry-after");
+  if (!value) return undefined;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1000);
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());
+}
+
+function assertResponseStatus(response: Response, context: string): void {
+  if (response.ok) return;
+  if (response.status === 401) throw new UsageError("invalid-credentials", `${context} rejected the session`);
+  if (response.status === 403) throw new UsageError("forbidden", `${context} is forbidden`);
+  if (response.status === 429) {
+    throw new UsageError("rate-limited", `${context} is rate limited`, retryAfterMs(response));
+  }
+  if (response.status >= 500) throw new UsageError("transient", `${context} failed with HTTP ${response.status}`);
+  throw new UsageError("invalid-response", `${context} failed with HTTP ${response.status}`);
+}
+
+function isAuthenticationUrl(url: URL): boolean {
+  const path = url.pathname.toLowerCase().replace(/\/+$/, "");
+  return path === "/login" || path === "/signin" || path === "/console/login" || path === "/auth/authorize";
+}
+
+async function fetchSameHost(url: string, init: RequestInit): Promise<Response> {
+  let currentUrl = new URL(url);
+  let currentInit = init;
+  for (let redirects = 0; redirects <= 5; redirects++) {
+    let response: Response;
+    try {
+      response = await fetch(currentUrl, { ...currentInit, redirect: "manual" });
+    } catch (error) {
+      throw classifyUsageError(error);
+    }
+    if (response.status < 300 || response.status >= 400) return response;
+
+    const location = response.headers.get("location");
+    if (!location) throw new UsageError("invalid-response", "OpenCode Go redirect is missing a location");
+    const nextUrl = new URL(location, currentUrl);
+    if (nextUrl.protocol !== "https:" || nextUrl.hostname !== "opencode.ai") {
+      throw new UsageError("invalid-response", "OpenCode Go refused a cross-origin redirect");
+    }
+    if (isAuthenticationUrl(nextUrl)) {
+      throw new UsageError("invalid-credentials", "OpenCode Go session redirected to sign in");
+    }
+    if (response.status === 303 || ((response.status === 301 || response.status === 302) && currentInit.method === "POST")) {
+      currentInit = { ...currentInit, method: "GET", body: undefined };
+    }
+    currentUrl = nextUrl;
+  }
+  throw new UsageError("invalid-response", "OpenCode Go exceeded the redirect limit");
 }
 
 function extractWorkspaceIds(text: string): string[] {
@@ -232,7 +343,7 @@ function parseSubscriptionPage(text: string): {
   hasMonthly: boolean;
 } {
   if (isSignedOut(text)) {
-    throw new InvalidCredentialsError("Session is signed out");
+    throw new UsageError("invalid-credentials", "Session is signed out");
   }
 
   // Strategy 1: JSON direct lookup
@@ -343,7 +454,7 @@ function parseSubscriptionPage(text: string): {
   const weeklyPercent = weeklyPercentMatch ? Number.parseFloat(weeklyPercentMatch[1]!) : null;
 
   if (rollingPercent === null || weeklyPercent === null) {
-    throw new ParseError("Missing usage fields.");
+    throw new UsageError("invalid-response", "Missing usage fields.");
   }
 
   return {
@@ -357,27 +468,40 @@ function parseSubscriptionPage(text: string): {
   };
 }
 
-export class OpenCodeGoUsageClient implements UsageClient<{ cookies: string; serverFnId: string }, OpenCodeGoUsageSnapshot> {
-  async fetch(creds: { cookies: string; serverFnId: string }, options?: { signal?: AbortSignal }): Promise<OpenCodeGoUsageSnapshot> {
-    const workspace = await this.resolveWorkspace(creds.cookies, creds.serverFnId, options?.signal);
+export class OpenCodeGoUsageClient implements UsageClient<OpenCodeGoClientCredentials, OpenCodeGoUsageSnapshot> {
+  async fetch(creds: OpenCodeGoClientCredentials, options?: { signal?: AbortSignal }): Promise<OpenCodeGoUsageSnapshot> {
+    let cookies = buildAuthCookieHeader(parseCookieHeader(creds.cookies));
+    const request = async (url: string, init: RequestInit = {}): Promise<Response> => {
+      const headers = new Headers(init.headers);
+      headers.set("Cookie", cookies);
+      const response = await fetchSameHost(url, { ...init, headers, signal: options?.signal });
+      const rotated = applyAuthCookieRotation(cookies, response.headers);
+      if (rotated !== cookies) {
+        cookies = rotated;
+        creds.onCookieRotation?.(cookies);
+      }
+      return response;
+    };
+
+    const workspace = await this.resolveWorkspace(creds.serverFnId, request);
     const url = `https://opencode.ai/workspace/${workspace.id}/go`;
 
-    const res = await fetch(url, {
-      signal: options?.signal,
+    const res = await request(url, {
       headers: {
-        Cookie: creds.cookies,
         "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
         Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
       },
     });
+    assertResponseStatus(res, "OpenCode Go subscription request");
 
-    if (res.status === 401 || res.status === 403) {
-      throw new InvalidCredentialsError("OpenCode Go session invalid");
+    let text: string;
+    try {
+      text = await res.text();
+    } catch (error) {
+      throw classifyUsageError(error);
     }
-
-    const text = await res.text();
     if (isSignedOut(text)) {
-      throw new InvalidCredentialsError("OpenCode Go session is signed out");
+      throw new UsageError("invalid-credentials", "OpenCode Go session is signed out");
     }
 
     const parsed = parseSubscriptionPage(text);
@@ -397,9 +521,11 @@ export class OpenCodeGoUsageClient implements UsageClient<{ cookies: string; ser
     };
   }
 
-  private async resolveWorkspace(cookies: string, serverFnId: string, signal?: AbortSignal): Promise<{ id: string; name: string | null }> {
+  private async resolveWorkspace(
+    serverFnId: string,
+    request: (url: string, init?: RequestInit) => Promise<Response>,
+  ): Promise<{ id: string; name: string | null }> {
     const headers: Record<string, string> = {
-      Cookie: cookies,
       "X-Server-Id": serverFnId,
       "X-Server-Instance": `server-fn:${randomUuid()}`,
       "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
@@ -409,31 +535,41 @@ export class OpenCodeGoUsageClient implements UsageClient<{ cookies: string; ser
     };
 
     // GET attempt
-    let res = await fetch(`https://opencode.ai/_server?id=${serverFnId}`, { headers, signal });
-    let text = await res.text();
+    let res = await request(`https://opencode.ai/_server?id=${serverFnId}`, { headers });
+    assertResponseStatus(res, "OpenCode Go workspace request");
+    let text: string;
+    try {
+      text = await res.text();
+    } catch (error) {
+      throw classifyUsageError(error);
+    }
 
     if (isSignedOut(text)) {
-      throw new InvalidCredentialsError("OpenCode Go session is signed out");
+      throw new UsageError("invalid-credentials", "OpenCode Go session is signed out");
     }
 
     let workspace = extractWorkspace(text);
     if (!workspace) {
       // POST fallback
-      res = await fetch("https://opencode.ai/_server", {
+      res = await request("https://opencode.ai/_server", {
         method: "POST",
-        signal,
         headers: { ...headers, "Content-Type": "application/json" },
         body: "[]",
       });
-      text = await res.text();
+      assertResponseStatus(res, "OpenCode Go workspace request");
+      try {
+        text = await res.text();
+      } catch (error) {
+        throw classifyUsageError(error);
+      }
       if (isSignedOut(text)) {
-        throw new InvalidCredentialsError("OpenCode Go session is signed out");
+        throw new UsageError("invalid-credentials", "OpenCode Go session is signed out");
       }
       workspace = extractWorkspace(text);
     }
 
     if (!workspace) {
-      throw new ParseError("Missing workspace id.");
+      throw new UsageError("invalid-response", "Missing workspace id.");
     }
 
     return workspace;

package/src/usage/errors.ts

@@ -0,0 +1,33 @@
+export type UsageFailureKind =
+  | "invalid-credentials"
+  | "forbidden"
+  | "rate-limited"
+  | "transient"
+  | "invalid-response"
+  | "cancelled";
+
+export class UsageError extends Error {
+  constructor(
+    public readonly kind: UsageFailureKind,
+    message: string,
+    public readonly retryAfterMs?: number,
+  ) {
+    super(message);
+    this.name = "UsageError";
+  }
+}
+
+export function classifyUsageError(error: unknown): UsageError {
+  if (error instanceof UsageError) return error;
+  if (error instanceof DOMException && error.name === "AbortError") {
+    return new UsageError("cancelled", "Usage request cancelled");
+  }
+  if (error instanceof Error && error.name === "AbortError") {
+    return new UsageError("cancelled", "Usage request cancelled");
+  }
+  return new UsageError("transient", error instanceof Error ? error.message : String(error));
+}
+
+export function isRecoverableAuthenticationError(error: unknown): boolean {
+  return classifyUsageError(error).kind === "invalid-credentials";
+}

package/src/usage/index.ts

@@ -8,11 +8,12 @@ export { ClaudeUsageProvider } from "./providers/claude";
 export { CodexUsageProvider } from "./providers/codex";
 export { OpenCodeGoUsageProvider } from "./providers/opencode-go";
 export { ClaudeAuthResolver } from "./resolvers/claude-auth";
+export { ClaudeDesktopAuthResolver } from "./resolvers/claude-desktop-auth";
 export { ClaudeWebResolver } from "./resolvers/claude-web";
 export { ClaudeCliResolver } from "./resolvers/claude-cli";
 export { CodexAuthResolver } from "./resolvers/codex-auth";
 export { OpenCodeGoWebResolver } from "./resolvers/opencode-go-web";
-export { extractCookies, buildCookieHeader } from "./resolvers/browser-cookies";
+export { extractCookies, buildCookieHeader, decryptSafeStorageBlob, getChromiumSafeStorageKey } from "./resolvers/browser-cookies";
 export { AnthropicOAuthUsageClient } from "./clients/anthropic-oauth-usage";
 export { AnthropicWebUsageClient } from "./clients/anthropic-web-usage";
 export { CodexOAuthUsageClient } from "./clients/codex-oauth-usage";

package/src/usage/local/opencode-go-local.ts

@@ -0,0 +1,194 @@
+import { Database } from "bun:sqlite";
+import { resolveDbCandidates } from "../../daemon/collectors/opencode-db";
+import type { OpenCodeGoUsageSnapshot } from "../types";
+
+const FIVE_HOURS_SEC = 5 * 60 * 60;
+const WEEK_SEC = 7 * 24 * 60 * 60;
+const SESSION_LIMIT_USD = 12;
+const WEEKLY_LIMIT_USD = 30;
+const MONTHLY_LIMIT_USD = 60;
+
+export interface OpenCodeGoLocalUsageFetcher {
+  fetch(now?: Date): Promise<OpenCodeGoUsageSnapshot | null>;
+}
+
+interface UsageRow {
+  createdMs: number;
+  cost: number;
+}
+
+const MESSAGE_USAGE_SQL = `
+  SELECT
+    CAST(COALESCE(json_extract(data, '$.time.created'), time_created) AS INTEGER) AS createdMs,
+    CAST(json_extract(data, '$.cost') AS REAL) AS cost
+  FROM message
+  WHERE json_valid(data)
+    AND json_extract(data, '$.providerID') = 'opencode-go'
+    AND json_extract(data, '$.role') = 'assistant'
+    AND json_type(data, '$.cost') IN ('integer', 'real')
+`;
+
+const MESSAGE_AND_PART_USAGE_SQL = `
+  WITH provider_messages AS (
+    SELECT
+      id AS messageID,
+      CAST(COALESCE(json_extract(data, '$.time.created'), time_created) AS INTEGER) AS createdMs,
+      CAST(json_extract(data, '$.cost') AS REAL) AS cost,
+      json_type(data, '$.cost') IN ('integer', 'real') AS hasCost
+    FROM message
+    WHERE json_valid(data)
+      AND json_extract(data, '$.providerID') = 'opencode-go'
+      AND json_extract(data, '$.role') = 'assistant'
+  )
+  SELECT
+    CAST(COALESCE(json_extract(p.data, '$.time.created'), p.time_created, m.createdMs) AS INTEGER) AS createdMs,
+    CAST(json_extract(p.data, '$.cost') AS REAL) AS cost
+  FROM part p
+  JOIN provider_messages m ON m.messageID = p.message_id
+  WHERE json_valid(p.data)
+    AND json_extract(p.data, '$.type') = 'step-finish'
+    AND json_type(p.data, '$.cost') IN ('integer', 'real')
+  UNION ALL
+  SELECT createdMs, cost
+  FROM provider_messages m
+  WHERE hasCost
+    AND NOT EXISTS (
+      SELECT 1
+      FROM part p
+      WHERE p.message_id = m.messageID
+        AND json_valid(p.data)
+        AND json_extract(p.data, '$.type') = 'step-finish'
+        AND json_type(p.data, '$.cost') IN ('integer', 'real')
+    )
+`;
+
+export class OpenCodeGoLocalUsageReader implements OpenCodeGoLocalUsageFetcher {
+  async fetch(now: Date = new Date()): Promise<OpenCodeGoUsageSnapshot | null> {
+    for (const dbPath of resolveDbCandidates()) {
+      let db: Database | undefined;
+      try {
+        db = new Database(dbPath, { readonly: true });
+        const rows = readLocalRows(db);
+        if (rows.length > 0) {
+          return buildLocalSnapshot(rows, now);
+        }
+      } catch {
+        // Missing or corrupt databases are not usable local usage sources.
+      } finally {
+        db?.close();
+      }
+    }
+    return null;
+  }
+}
+
+function readLocalRows(db: Database): UsageRow[] {
+  const partMatch = db
+    .query<unknown, [string]>("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1")
+    .get("part");
+  // bun:sqlite returns null (not undefined) when a row cannot be resolved.
+  const hasPartTable = partMatch !== null && partMatch !== undefined;
+  const statement = db.query<RowShape, []>(hasPartTable ? MESSAGE_AND_PART_USAGE_SQL : MESSAGE_USAGE_SQL);
+  const rows: UsageRow[] = [];
+  for (const row of statement.all()) {
+    const createdMs = Number(row.createdMs);
+    const cost = Number(row.cost);
+    if (Number.isFinite(createdMs) && createdMs > 0 && Number.isFinite(cost) && cost >= 0) {
+      rows.push({ createdMs, cost });
+    }
+  }
+  return rows;
+}
+
+interface RowShape {
+  createdMs: number | null;
+  cost: number | null;
+}
+
+interface MonthBounds {
+  startMs: number;
+  endMs: number;
+}
+
+export function buildLocalSnapshot(rows: UsageRow[], now: Date): OpenCodeGoUsageSnapshot {
+  const nowMs = now.getTime();
+  const sessionStartMs = nowMs - FIVE_HOURS_SEC * 1000;
+  const weekStartMs = startOfUtcWeek(now).getTime();
+  const weekEndMs = weekStartMs + WEEK_SEC * 1000;
+  const { startMs, endMs } = monthBounds(now, rows);
+
+  let sessionCost = 0;
+  let weekCost = 0;
+  let monthCost = 0;
+  let oldestSessionMs: number | undefined;
+  for (const row of rows) {
+    if (row.createdMs >= sessionStartMs && row.createdMs < nowMs) {
+      sessionCost += row.cost;
+      if (oldestSessionMs === undefined || row.createdMs < oldestSessionMs) oldestSessionMs = row.createdMs;
+    }
+    if (row.createdMs >= weekStartMs && row.createdMs < weekEndMs) {
+      weekCost += row.cost;
+    }
+    if (row.createdMs >= startMs && row.createdMs < endMs) {
+      monthCost += row.cost;
+    }
+  }
+
+  const oldestSession = oldestSessionMs ?? nowMs;
+  return {
+    source: "local",
+    hasMonthlyUsage: true,
+    rollingUsagePercent: percentOf(sessionCost, SESSION_LIMIT_USD),
+    weeklyUsagePercent: percentOf(weekCost, WEEKLY_LIMIT_USD),
+    monthlyUsagePercent: percentOf(monthCost, MONTHLY_LIMIT_USD),
+    rollingResetInSec: Math.max(0, Math.round((oldestSession + FIVE_HOURS_SEC * 1000 - nowMs) / 1000)),
+    weeklyResetInSec: Math.max(0, Math.round((weekEndMs - nowMs) / 1000)),
+    monthlyResetInSec: Math.max(0, Math.round((endMs - nowMs) / 1000)),
+    updatedAt: now,
+    workspaceId: null,
+    workspaceName: null,
+  };
+}
+
+function percentOf(used: number, limit: number): number {
+  if (!Number.isFinite(used) || limit <= 0) return 0;
+  return Math.max(0, Math.min(100, Math.round((used / limit) * 1000) / 10));
+}
+
+function startOfUtcWeek(now: Date): Date {
+  const midnight = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
+  const weekdayIndex = (midnight.getUTCDay() + 6) % 7; // Monday = 0
+  return new Date(midnight.getTime() - weekdayIndex * 24 * 60 * 60 * 1000);
+}
+
+function monthBounds(now: Date, rows: UsageRow[]): MonthBounds {
+  const earliestMs = rows.length > 0 ? Math.min(...rows.map((row) => row.createdMs)) : undefined;
+  const anchor = earliestMs !== undefined ? new Date(earliestMs) : now;
+
+  // Month window anchored to the earliest local row (billing-cycle estimate),
+  // mirroring CodexBar's OpenCodeGoLocalUsageReader month heuristic.
+  const start = new Date(Date.UTC(
+    now.getUTCFullYear(),
+    now.getUTCMonth(),
+    anchor.getUTCDate(),
+    anchor.getUTCHours(),
+    anchor.getUTCMinutes(),
+    anchor.getUTCSeconds(),
+  ));
+  const shifted = start.getTime() > now.getTime()
+    ? new Date(start.getTime() - 31 * 24 * 60 * 60 * 1000)
+    : start;
+  const end = new Date(Date.UTC(
+    shifted.getUTCFullYear() + (shifted.getUTCMonth() === 11 ? 1 : 0),
+    shifted.getUTCMonth() === 11 ? 0 : shifted.getUTCMonth() + 1,
+    Math.min(shifted.getUTCDate(), daysInUtcMonth(shifted.getUTCFullYear(), shifted.getUTCMonth() === 11 ? 0 : shifted.getUTCMonth() + 1)),
+    shifted.getUTCHours(),
+    shifted.getUTCMinutes(),
+    shifted.getUTCSeconds(),
+  ));
+  return { startMs: shifted.getTime(), endMs: end.getTime() };
+}
+
+function daysInUtcMonth(year: number, month: number): number {
+  return new Date(Date.UTC(year, month + 1, 0)).getUTCDate();
+}

package/src/usage/mappers.ts

@@ -83,7 +83,7 @@ export function mapClaudeToEntry(
     provider: "claude",
     accountId: buildClaudeAccountId(snapshot, oauthCreds),
     available,
-    status: snapshot ? (errors.length > 0 ? "error" : "ok") : available ? "error" : "unavailable",
+    status: snapshot ? "ok" : available ? "error" : "unavailable",
   };
 
   if (!snapshot) {
@@ -129,10 +129,6 @@ export function mapClaudeToEntry(
     rateLimitTier: snapshot.rateLimitTier,
   };
 
-  if (errors.length > 0) {
-    base.errors = errors;
-  }
-
   base.windows = windows;
   base.cost = cost;
   base.updatedAt = toIsoString(snapshot.updatedAt) ?? new Date().toISOString();
@@ -144,14 +140,17 @@ export function buildCodexAccountId(
   snapshot: CodexUsageSnapshot | null,
   oauthCreds: CodexOAuthCredentials | null,
 ): string | null {
-  if (oauthCreds?.accountEmail) {
-    return oauthCreds.accountEmail;
+  if (snapshot?.accountId) {
+    return snapshot.accountId;
+  }
+  if (snapshot?.accountEmail) {
+    return snapshot.accountEmail;
   }
   if (oauthCreds?.accountId) {
     return oauthCreds.accountId;
   }
-  if (snapshot?.accountEmail) {
-    return snapshot.accountEmail;
+  if (oauthCreds?.accountEmail) {
+    return oauthCreds.accountEmail;
   }
   if (snapshot?.planType) {
     return `codex-${snapshot.planType}`;
@@ -169,7 +168,7 @@ export function mapCodexToEntry(
     provider: "codex",
     accountId: buildCodexAccountId(snapshot, oauthCreds),
     available,
-    status: snapshot ? (errors.length > 0 ? "error" : "ok") : available ? "error" : "unavailable",
+    status: snapshot ? "ok" : available ? "error" : "unavailable",
   };
 
   if (!snapshot) {
@@ -187,11 +186,21 @@ export function mapCodexToEntry(
   const secondary = mapRateWindowLegacyToWindow("weekly", "Weekly", snapshot.secondaryWindow);
   if (secondary) windows.push(secondary);
 
-  // Codex usage API provides rate windows (percentages) and credits (balance/remaining).
-  // It does not expose separate "used" vs "limit" absolute amounts, so a
-  // ProviderCostSnapshot cannot be accurately constructed.  Only rate windows are
-  // mapped; credit balance is surfaced via metadata instead of cost.
-  const cost: ProviderCostSnapshot | null = null;
+  const balance = snapshot.credits?.hasCredits && !snapshot.credits.unlimited
+    ? snapshot.credits.balance
+    : null;
+  const individualLimit = snapshot.individualLimit;
+  const cost: ProviderCostSnapshot | null = individualLimit || balance !== null
+    ? {
+        used: individualLimit?.used ?? 0,
+        limit: individualLimit?.limit ?? 0,
+        currency: "Credits",
+        period: "Extra usage",
+        ...(balance !== null ? { balance } : {}),
+        resetsAt: toIsoString(individualLimit?.resetsAt ?? null),
+        updatedAt: toIsoString(snapshot.updatedAt) ?? new Date().toISOString(),
+      }
+    : null;
 
   base.metadata = {
     dataSource: snapshot.source,