osdy-pi 1.11.1 → 1.11.3

package/README.md

@@ -6,16 +6,19 @@ Osdy Pi gives [Pi](https://github.com/earendil-works/pi) a themed, responsive te
 
 ## Release highlights
 
+**The Control Center consolidates Osdy controls in `/osdyConfig`**: ten categories cover appearance, Git, sounds, accounts, usage, and TODO/Agents provider settings. Account quota previews query a selected stored Codex profile without switching it. The header shows the installed Osdy package version when it fits; constrained layouts show only the centered mascot. See [Control Center in Pi](#control-center-in-pi) for confirmation and persistence boundaries.
+
 **1.11.0 adds three Spider-Man-inspired dark palettes**, bringing the bundle to **23 themes**. It retains the four-page local usage analytics introduced in 1.10.0, with shared period and profile/provider/model filters, keyboard navigation, and metadata-only history. These version introductions are historical, not a fixed latest-version claim. After npm Trusted Publishing is configured, pushes to main (including direct pushes) run checks and attempt to publish an automatically allocated patch to npm. Failed checks publish nothing; authentication or registry failures can also stop publication. Verify the resolved npm version before installing. Maintainers: [automatic npm publishing setup](https://github.com/OsdyOrtiz/Osdy-Pi/blob/main/docs/npm-publishing.md).
 
 | Area | What ships |
 | --- | --- |
+| Control Center | `/osdyConfig` opens ten categories, including confirmed TODO/Agents provider selection and explicit per-profile Codex quota previews. |
 | Local analytics (1.10.0) | `/osdy-usage` opens Summary, Profiles, Models, and History pages for recorded tokens and estimated cost—not billing or subscription quota. |
 | Themes introduced in 1.11.0 | Spider-Man Classic, Miles Morales, and Spider-Verse add three distinct dark palettes. |
 | Themes introduced in 1.9.0 | Halloween and Halloween Killer add two dark palettes. |
 | Themes introduced in 1.8.0 | Gruvbox Dark, Nord, Rosé Pine base dark, and Daniela Cute. |
 | Message cards | Pi-native colored user cards without emojis and plain assistant Markdown preceded by a separate `🦝` transcript row. |
-| Header and mascot | A theme-aware `neon` header and selectable `bts` mascot, both responsive and persisted independently. |
+| Header and mascot | Independent header/mascot choices, an installed-package version label, and mascot-only fallback when full artwork cannot fit. |
 | Accounts | `/osdy-account` switches Codex profiles in place with atomic activation, rollback, bounded auth files, and process-safe locks. |
 | Quota | `/usage` and compact bars emphasize remaining Codex quota at warning (40% or less) and error (15% or less) thresholds. |
 | TODO (starting in 1.5.0, opt-in) | Default-off first-party `todo` snapshots track the Pi session branch; `/todos` reads them without editing. ODD Markdown remains separate. |
@@ -52,6 +55,26 @@ Osdy Pi gives [Pi](https://github.com/earendil-works/pi) a themed, responsive te
 
 Osdy Pi's own extension and themes are bundled—do not install them separately. Starting with **1.11.0**, the package bundles **23 themes**, including Spider-Man Classic, Miles Morales, and Spider-Verse: Gruvbox Dark, Nord, Rosé Pine base dark, and Daniela Cute were introduced in 1.8.0; Halloween and Halloween Killer were added in 1.9.0. Check your installed npm version to see which themes are available. Launch through `osdy-pi` (or `npm run pi:dev`) to activate a valid Osdy default account into Pi's shared agent directory before Pi starts. With no default, Pi remains unmanaged; run `/osdy-account` to create a profile and establish a default. On session start, Osdy Pi restores its persisted enabled state when a UI is available and preserves your selected Pi theme. When disabled, it leaves Gentle Shell (or Pi's native UI) untouched.
 
+### Control Center in Pi
+
+Run **`/osdyConfig`** in interactive Pi to open the Osdy Control Center. The ten categories—**Theme, Header, Mascot, Editor, Git, Sounds, Account, Usage, TODO, and Agents**—provide inline controls or data in the same modal. Existing commands remain available.
+
+- Use **↑/↓**, **Home/End**, or **Page Up/Down** to navigate; **Tab** or **←/→** switches between categories and details. **Enter** selects.
+- TODO shows configured selection, current eligibility, and actually loaded SDK registration separately. Opt-in/out requires an idle session and a Cancel-first inline confirmation naming the target, owned Gentle filter effects, and reload. Successful selection closes/disposes the panel and releases its editor hold before reloading once; restart Pi if reload fails. Rejections stay in the panel. No installs or task-history changes occur; legacy `/osdy-pi todo on|off|status` remains available.
+- Agents inspects Joker/Gentle configuration without activating anything. Selection is idle-only and Cancel-first confirmed, naming the real target, possible Joker installation, owned agent filters, and preserved unrelated resources. Normal personal Pi only: `pi:dev` and isolated/override sessions are blocked, never redirected to personal settings. Success closes/disposes the panel and releases its editor hold before reloading once; restart Pi if reload fails. Legacy `/osdy-pi agents setup|on|off|status` is unchanged.
+- Theme lists Pi's available themes and marks the current theme. A successful selection applies live and saves globally in the active Pi agent directory; project settings can override it at startup. Failures appear in the modal.
+- Header offers **osdy-theme / neon**; Mascot offers **current / Bts**; Editor offers **auto / extended / simple**, with the current preference marked. Editor also shows the effective mode: small terminals stay simple/native even with extended selected.
+- Preferences save immediately through the same runtime and global Osdy settings store as `/osdy-pi` commands (`<agent-dir>/extensions/osdy-pi/settings.json`). Header/Mascot apply live without closing the panel. Editor replacement waits until all overlays close; if another overlay remains, the next existing responsive watcher tick applies the latest choice. The effective mode reports the actually mounted editor while queued. Opening a category only reads values; while Osdy is disabled, choices save for later without enabling it.
+- A selection shows **Saving** until persistence finishes and **Saved globally** only on success. Failed saves retain the live preference but report **could not be saved**; select again to retry. Application errors report **Not saved**, without claiming the runtime change succeeded. Duplicate selections are ignored while saving.
+- **Git** shows the current branch (or detached HEAD), changed-entry count/clean status, and the current widget position as a read-only session detail. Working-tree enablement applies and saves through the same owner as `/osdy-pi working-tree`; Git inspection never writes Git. `/osdy-pi diff` and position commands are unchanged.
+- **Sounds** shows each event's saved and effective path/source. Configure opens a single-line path editor **inside this overlay**: enter a readable `.mp3`/`.wav` path, then **Enter** to validate and save immediately, or **Esc** to cancel editing. Relative paths resolve against the project directory and save as absolute paths. Clear removes only that event's saved path from the existing v1 audio store (`<agent-dir>/extensions/osdy-pi/audio-notifications.json`). Notifications read this store afresh; refresh failures are reported separately from save failures.
+- Sounds' master enablement is **unavailable**: the existing schema has paths, not an enable switch or presets. Startup `--osdy-pi-sound-<event>` flags override saved paths, so **clearing a saved path does not disable flag-configured playback**. Only **Test effective** explicitly plays a sound; opening categories and configuring paths never play. Tests report unavailable files/platforms or playback failures; playback remains macOS/Windows only. The legacy `/osdy-pi sound setup` wizard is preserved.
+- **Account** lists validated profiles and current/default metadata. **View usage: profile** explicitly queries that profile's stored Codex credentials without activating it; opening, navigating or highlighting never queries. The preview shows remaining quota, next resets and checked time (local time); absent data is unknown, not zero. Switch, set default, and clear default require an **in-screen confirmation** with Cancel selected initially; **Esc** cancels confirmation without closing the overlay. Resize if the confirmation cannot fit. Switching waits for Pi to become idle, activates through the existing backend, and refreshes subscription usage. Login remains Pi-owned (`/login`); create/rename/remove remain available in `/osdy-account`. Category navigation never changes profiles or credentials.
+- **Usage** shows the runtime's cached subscription quota (used percentage, window, reset/fetch times) and the existing local history owner's recorded token/cache totals, cost gaps, and model detail. Select **Range: day/week/month** for the current local calendar period; toggle **Accounts: all/current** for local analytics (unmanaged when no valid current profile exists). Quota always belongs to the active account, not the analytics filter. Select **Refresh quota and local history** explicitly; rendering and filters never fetch. Empty, loading, unavailable, and limited/incomplete coverage are reported honestly. Estimates are not billing or subscription quota. `/usage` and `/osdy-usage` remain unchanged.
+- **Esc** closes without undoing live or saved changes. Account read-only previews are cancelled on category exit or close; late results are ignored even if cancellation is not honored. Other in-flight operations still finish and are not claimed cancelled. Late results cannot replace a closed overlay or another category. On narrow terminals, categories and details share the viewport; use Tab to switch.
+
+This modal requires Pi's terminal UI, not RPC, JSON, or print mode. `/osdy-pi` remains the legacy extension command; the external shell command `osdy` (`bin/osdy.mjs`) remains the isolated launcher described below.
+
 ### Optional: isolated `osdy` command
 
 Use this path when you want **installed, normal Pi** with Osdy-specific settings and sessions, without changing the official Pi profile. `pi install` loads package resources in Pi; it does not guarantee that package executables are available on your shell's `PATH`. To use the packaged commands, install the CLI separately (or run the scripts directly from a checkout):
@@ -193,6 +216,10 @@ For a project-local installation, run `pi remove -l npm:@juicesharp/rpiv-todo` i
 
 ## OpenAI account profiles
 
+**Quick path:** `/osdyConfig` → **Account** → **View usage: profile** → optionally **Switch to profile** (Activate, Cancel-first confirmation). Each profile has its own explicit preview before its separate switch operation; the active profile also has a preview.
+
+Preview is **Codex only**, a live query using the selected profile's **stored credentials snapshot**, with no automatic refresh. It never activates, borrows active credentials, refreshes tokens, writes auth, changes models/session state or overwrites active quota. Missing, malformed, expired or remotely rejected snapshots are unavailable—not zero quota. Even the current profile's stored snapshot may be stale: log in and save through the normal account workflow outside preview. Profile labels and decoded JWT claims do not verify human identity or server validity. Local history remains token/cost estimates, not subscription quota. Legacy `/osdy-account`, `/usage` and `/osdy-usage` remain unchanged; Agents configuration remains normal personal Pi only.
+
 Osdy Pi can keep multiple ChatGPT Plus/Pro accounts authenticated and let you choose which one starts Pi. `personal` and `work` are only examples—you can create as many named profiles as you need.
 
 ### Create and use profiles
@@ -240,12 +267,14 @@ Profile names accept ASCII letters, numbers, and hyphens, up to 63 characters, p
 
 ### See and switch the active account
 
-When Pi was launched through a profile, Osdy Pi shows its profile name in the editor:
+Direct `pi` startup restores the last activated profile label from valid active-account metadata. A valid explicit launcher profile (`OSDY_PI_PROFILE_NAME`) takes precedence. Osdy Pi shows the profile name in the editor:
 
 - **Simple/native editor:** beside the model, for example `gpt-5.6-sol · personal · think high`.
 - **Extended/framed editor:** `personal` replaces the `Osdy-Pi` title.
 - **No managed profile:** the existing model line and `Osdy-Pi` title remain unchanged.
 
+Label recovery is visual only: it does not switch credentials or change the configured default. Missing, invalid, unreadable, or stale active-account metadata keeps the existing fallback.
+
 `account use <name>` activates the profile in Pi's shared agent directory, saves it as active/default, then starts Pi. Inside Pi, `/osdy-account` waits for active work to finish and swaps the canonical `auth.json` in place; the next request resolves the new account without a spawn, shutdown, session handoff, or restart.
 
 To resume a specific session directly from the terminal:
@@ -254,7 +283,7 @@ To resume a specific session directly from the terminal:
 osdy-pi account use work -- --session /absolute/path/to/session.jsonl
 ```
 
-> **Privacy:** each profile keeps a private `auth.json`; Pi runs against its canonical shared `auth.json`. Osdy Pi atomically copies opaque auth files between those private locations only to activate or preserve an account; it never parses, prints, logs, or passes OAuth credentials. Session history, settings, installed packages, and extension resources are shared, so every profile can access that local state. It keeps Pi's canonical `openai-codex` provider and delegates authentication to Pi's built-in `/login` flow.
+> **Privacy:** each profile keeps a private `auth.json`; Pi runs against its canonical shared `auth.json`. Account activation/preservation atomically copies opaque auth files. The separate explicit **View usage: profile** preview reads a bounded stored auth snapshot, parses its Codex OAuth fields and unverified JWT claims, and sends the access token/account ID only to the fixed HTTPS Codex usage endpoint. It never refreshes tokens, logs in, switches accounts, writes auth, or queries automatically; it does not print or log credentials. Session history, settings, installed packages, and extension resources are shared, so every profile can access that local state. It keeps Pi's canonical `openai-codex` provider and delegates authentication to Pi's built-in `/login` flow.
 
 Account switching is serialized in-process and protected by a private cross-process lock. Osdy Pi accepts only bounded regular auth files, refuses symlink-based auth sources, writes replacements with private permissions, and restores the previous canonical auth and account metadata when activation fails. A separate namespace lock protects concurrent profile creation, rename, and removal. Launchers activate the selected auth before starting Pi while continuing to use the shared agent directory; existing managed-directory links from earlier profile layouts are resolved for compatibility.
 
@@ -341,7 +370,9 @@ Header and mascot choices are independent:
 
 Both commands update the UI immediately. Add `status` instead of a choice to inspect the current selection. Choices persist in the global Osdy Pi settings across reloads and sessions. The old top-level style commands and `classic` header aliases are no longer registered.
 
-In normal mode, the selected header and mascot render side by side. The Neon header derives its highlights from the active theme rather than using one fixed palette. Each mascot keeps its own tone map while its animated edge glow can resolve through theme colors. Header and mascot scaling remain independent, so any combination follows the same responsive layout rules.
+The header also shows **`osdy-pi v<version>`** at the top right in the theme's accent color, read from the installed Osdy package—not Pi's host version or the workspace manifest. It uses an empty first row or adds a row without overwriting artwork; invalid/unreadable versions or labels wider than the terminal are omitted.
+
+In normal mode, the selected header and mascot render side by side when both fit. The Neon header derives its highlights from the active theme rather than using one fixed palette. Each mascot keeps its own tone map while its animated edge glow can resolve through theme colors. Header and mascot scaling remain independent, so any combination follows the same responsive layout rules.
 
 Animation is enabled by default with an intro animation. Configure it through `OSDY_PI_ANIMATION`:
 
@@ -356,12 +387,12 @@ Animation is enabled by default with an intro animation. Configure it through `O
 | Terminal mode | Header and mascot | Editor and Git | Footer |
 | --- | --- | --- | --- |
 | Normal | Full selected header and mascot side by side | Auto mode shows the framed editor by default; simple selects Pi's native editor and extended selects the framed editor; Git summary when enabled | Native editor: model/thinking, usage, path/branch, then statuses; framed editor: path/branch then statuses |
-| Compact (72+ columns) | Proportionally scaled mascot above a readable header, reduced only when needed | Selected editor mode and Git behavior | Same editor-aware footer behavior as normal/small modes |
+| Compact (72+ columns, full artwork does not fit) | Centered mascot only; art and tone map scale proportionally | Selected editor mode and Git behavior | Same editor-aware footer behavior as normal/small modes |
 | Small (<72 columns) | Mascot only; art and tone map scale proportionally | Pi native editor for every editor mode; Git summary hidden | Model + styled thinking level, usage, path/branch, then dynamic extension statuses (except Pi Lens) |
 
 In the extended framed editor, the active thinking level is rendered in bold in the top-right model metadata so it remains easy to scan.
 
-Small and compact modes trim only fully empty mascot-art and tone-map margins before applying one proportional width-and-height scale; mascot width starts near four-fifths of the available width. The header moves below the mascot as soon as side-by-side width would force the mascot into an additional width-limited reduction. Compact headers retain their source art when it fits and reduce proportionally only when a width or row bound requires it. Compact headers and mascots share a bounded terminal-row budget, so the header is omitted rather than collapsed into an unreadable one-row logo when there is not enough vertical space. The small-mode footer places the model and styled bare thinking level above usage, path/branch, and dynamic extension statuses. Pi Lens's footer status is hidden in small mode, but Pi Lens continues running. Usage includes input/output/cache-read/cache-write tokens, cost, and context. Extension statuses are supplied dynamically by Pi/extensions and may include Osdy Pi, MCP, or LSP; they are not hardcoded.
+The full header and mascot render side by side only when the available width and height permit it without an additional width-limited mascot reduction. Otherwise, only the centered mascot renders—there is no scaled or stacked logo. Small and compact modes trim only fully empty mascot-art and tone-map margins before applying one proportional width-and-height scale; mascot width starts near four-fifths of the available width. The fallback mascot uses the available terminal rows, capped at 32 content rows, without reserving rows for a logo. The small-mode footer places the model and styled bare thinking level above usage, path/branch, and dynamic extension statuses. Pi Lens's footer status is hidden in small mode, but Pi Lens continues running. Usage includes input/output/cache-read/cache-write tokens, cost, and context. Extension statuses are supplied dynamically by Pi/extensions and may include Osdy Pi, MCP, or LSP; they are not hardcoded.
 
 The enabled state, editor mode, working-tree visibility preference, header, and mascot persist globally across Pi reloads and sessions, shared by all projects. They are saved in `$PI_CODING_AGENT_DIR/extensions/osdy-pi/settings.json`, or `~/.pi/agent/extensions/osdy-pi/settings.json` when `PI_CODING_AGENT_DIR` is unset. Existing settings without the new visual fields safely default to `osdy-theme` and `current`; the former `raccoon` mascot value migrates to `bts`. The selected editor mode and working-tree placement are restored when the terminal moves normal → small → normal.
 
@@ -369,6 +400,7 @@ The enabled state, editor mode, working-tree visibility preference, header, and
 
 | Group | Command |
 | --- | --- |
+| Control Center | `/osdyConfig` (interactive terminal UI) |
 | Main | `/osdy-pi` |
 | Main | `/osdy-pi enable\|disable\|on\|off\|status` |
 | Accounts | `/osdy-account` |
@@ -399,7 +431,7 @@ At wide widths, the modal pairs the Session and Weekly detail cards. Below 72 co
 
 Usage loads once when the session starts and refreshes when the modal opens or `r` is pressed; it does not poll. A refresh clears the previous snapshot before authentication resolves, and shutdown clears state, so quota data cannot cross account or profile boundaries.
 
-> **Privacy:** OAuth is resolved only through Pi's `modelRegistry`. Osdy Pi does not read `auth.json`, persist or log credentials, or display account IDs, tokens, response bodies, or endpoint internals in the UI. Requests use a fixed HTTPS endpoint with bounded timeout, response size, and redirects.
+> **Privacy:** this active-account `/usage` path resolves OAuth through Pi's `modelRegistry`, rather than directly reading auth files. The separate Control Center **View usage: profile** path reads the selected profile's bounded stored credentials snapshot; it never borrows active credentials or refreshes tokens, logs in, switches accounts, writes auth, or queries automatically. Both paths transmit the access token/account ID only to the fixed HTTPS Codex usage endpoint, reject redirects, and bound timeout and response size. Quota previews do not persist or log credentials or display account IDs, tokens, raw response bodies, or endpoint internals.
 
 ### Local usage analytics (starting in 1.10.0)
 
@@ -530,6 +562,26 @@ npm run pi:dev -- account remove private --confirm private
 PI_CODING_AGENT_DIR="$PWD/.pi-dev" OSDY_PI_DEV_EXTENSION_ROOT="$PWD" pi -e "$PWD"
 ```
 
+### Control Center manual smoke
+
+From this checkout with dependencies and Pi already available:
+
+```bash
+npm run pi:dev -- --no-session
+```
+
+This launches `pi` from `PATH`, loads this checkout with `-e`, and uses `.pi-dev` as the Pi agent directory.
+The explicit argument bypasses the launcher's default-account activation; Pi's `--no-session` disables session persistence, **not settings writes or provider access**.
+An isolated agent directory does **not** make custom audio paths or real provider accounts harmless. Use intentional disposable test profiles/files for profile writes, switches, default confirmations, and audio tests; do not assume an isolated account store makes real credentials safe.
+
+- Open `/osdyConfig` in regular and fullscreen Pi. Check arrows/Home/End/Page Up/Down, Tab or left/right, Enter, and Esc; shrink and restore the terminal, checking both panes remain reachable.
+- In disposable settings, change a visual preference, wait for **Saved globally**, close and reopen, then reload/restart to check persistence. Esc does not undo changes; distinguish save/application errors from success.
+- Account (manual): with disposable profiles only, check Cancel-first switch/set-default/clear-default confirmations, Esc cancellation, idle switching, and current/default labels. Check explicit **View usage: profile** before optional switching, no query on navigation, and cancellation on exit. Create/rename/remove stay in `/osdy-account`, login in `/login`.
+- Usage (manual): check day/week/month and all/current filters, empty/unavailable/limited states, and explicit refresh. Authenticated quota and post-switch account correctness need an intentionally authorized live provider check; local estimates are not billing.
+- Sounds (manual): use disposable readable `.mp3`/`.wav` files to check configure, cancel, clear, and startup-flag precedence. Only choose **Test effective** when playback is intended; actual macOS/Windows playback still needs a live check.
+
+Live TUI appearance, real account switching/authenticated quota, and actual audio playback remain unverified; this checklist is not a recorded pass.
+
 Install a local checkout into Pi with:
 
 ```bash
@@ -551,7 +603,8 @@ npm run pi:dev
 ## Limits and troubleshooting
 
 - The custom UI requires a Pi session with a UI; otherwise it does not mount.
-- A compact terminal stacks a scaled mascot over a source-size header when it fits, reducing the header only when needed; below 72 columns it switches to mascot-only, native editor, and no Git summary until space returns.
+- When the full side-by-side header and mascot cannot fit, only the centered, responsively scaled mascot renders; below 72 columns, Pi also uses the native editor and hides the Git summary until space returns.
+- Fullscreen mascot scrolling remains under investigation; the responsive header changes do not establish that this issue is fixed.
 - The Git summary reports unavailable when Git commands cannot read a working tree.
 - Diff patches depend on readable repository files; a file whose patch cannot load shows the reported error in the panel.
 - Audio playback is limited to macOS and Windows and to readable `.mp3`/`.wav` files.

package/extensions/osdy-pi/account-profiles.test.ts

@@ -7,6 +7,8 @@ import {
 	availableProfiles,
 	manageAccountProfile,
 	manageAccountProfiles,
+	narrowStoredProfileCodexCredential,
+	readStoredProfileCodexCredential,
 	parseDefaultAccountResult,
 	sharedAgentDir,
 	switchAccountInPlace,
@@ -14,6 +16,21 @@ import {
 	// @ts-ignore Node's native TypeScript runner resolves test-only TypeScript source imports.
 } from "./account-profiles.ts";
 
+void test("stored credential adapter narrows unknown data and conceals reader paths", async () => {
+	const credential = { profile: "Work", access: "synthetic", expires: 2_000_000_000_000 };
+	assert.deepEqual(narrowStoredProfileCodexCredential({ ...credential, refresh: "SECRET", raw: "SECRET" }), credential);
+	for (const value of [null, [], {}, { ...credential, profile: "../Work" }, { ...credential, expires: NaN }, { ...credential, accountId: null }]) {
+		assert.equal(narrowStoredProfileCodexCredential(value), undefined);
+	}
+	const root = await mkdtemp(join(tmpdir(), "osdy-quota-adapter-SECRET-"));
+	await assert.rejects(readStoredProfileCodexCredential(root, "Work"), (error: unknown) => {
+		assert(error instanceof Error);
+		assert.equal(error.message, "Stored profile credentials are unavailable.");
+		assert.doesNotMatch(JSON.stringify(error), /SECRET|auth.json/);
+		return true;
+	});
+});
+
 void test("uses the account resolver for split-agent roots and explicit overrides", async () => {
 	const candidate = await mkdtemp(join(tmpdir(), "osdy-pi-extension-agent-test-"));
 	const managedParent = await mkdtemp(join(tmpdir(), "osdy-pi-extension-managed-test-"));

package/extensions/osdy-pi/account-profiles.ts

@@ -38,8 +38,14 @@ export interface AccountProfilesCommandDependencies {
 	requestRender?: (() => void) | undefined;
 }
 
-function isProfileName(value: string): boolean {
-	return PROFILE_NAME.test(value) && !RESERVED_PROFILE_NAMES.has(value.toLowerCase());
+export function isProfileName(value: unknown): boolean {
+	return typeof value === "string" && PROFILE_NAME.test(value) && !RESERVED_PROFILE_NAMES.has(value.toLowerCase());
+}
+
+/** Validate external active metadata before exposing it to typed consumers. */
+export function readActiveProfileName(env: NodeJS.ProcessEnv = process.env): string | undefined {
+	const profile = env.OSDY_PI_PROFILE_NAME;
+	return typeof profile === "string" && isProfileName(profile) ? profile : undefined;
 }
 
 export async function sharedAgentDir(env: NodeJS.ProcessEnv): Promise<string> {
@@ -64,19 +70,63 @@ export async function availableProfiles(baseDir: string): Promise<string[]> {
 	return profiles.listProfiles(baseDir);
 }
 
+export type StoredProfileCodexCredential = {
+	profile: string;
+	access: string;
+	expires: number;
+	accountId?: string;
+};
+
+/** Narrow the local owner module's unknown result without exposing raw auth. */
+export function narrowStoredProfileCodexCredential(value: unknown): StoredProfileCodexCredential | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value) ||
+		!("profile" in value) || typeof value.profile !== "string" || !isProfileName(value.profile) ||
+		!("access" in value) || typeof value.access !== "string" || !value.access ||
+		!("expires" in value) || typeof value.expires !== "number" || !Number.isFinite(value.expires) ||
+		("accountId" in value && (typeof value.accountId !== "string" || !value.accountId))) return undefined;
+	return {
+		profile: value.profile,
+		access: value.access,
+		expires: value.expires,
+		...("accountId" in value && typeof value.accountId === "string" ? { accountId: value.accountId } : {}),
+	};
+}
+
+// The JavaScript owner accepts root/name strings; its return remains unknown until narrowed.
+function isStoredCredentialOwner(value: unknown): value is {
+	readStoredProfileCodexCredential(baseDir: string, profile: string): Promise<unknown>;
+} {
+	return !!value && typeof value === "object" && "readStoredProfileCodexCredential" in value &&
+		typeof value.readStoredProfileCodexCredential === "function";
+}
+
+export async function readStoredProfileCodexCredential(baseDir: string, profile: string): Promise<StoredProfileCodexCredential> {
+	try {
+		const moduleUrl = new URL("../../scripts/osdy-pi-account-profiles.mjs", import.meta.url).href;
+		const owner: unknown = await import(moduleUrl);
+		if (!isStoredCredentialOwner(owner)) throw new Error("Unavailable owner.");
+		const raw: unknown = await owner.readStoredProfileCodexCredential(baseDir, profile);
+		const credential = narrowStoredProfileCodexCredential(raw);
+		if (!credential || !sameProfile(credential.profile, profile)) throw new Error("Invalid snapshot.");
+		return credential;
+	} catch {
+		throw new Error("Stored profile credentials are unavailable.");
+	}
+}
+
 export async function switchAccountInPlace(
 	ctx: AccountContext,
 	profile: string,
 	activate: (profile: string) => Promise<void>,
 	refreshUsage?: () => Promise<void>,
 	requestRender?: () => void,
-): Promise<void> {
+): Promise<boolean> {
 	if (!isProfileName(profile)) {
 		ctx.ui.notify(
 			"Cannot switch accounts: the selected profile name is invalid.",
 			"warning",
 		);
-		return;
+		return false;
 	}
 	if (!ctx.isIdle()) await ctx.waitForIdle();
 	try {
@@ -86,7 +136,7 @@ export async function switchAccountInPlace(
 			"Cannot switch accounts: the account files could not be safely activated.",
 			"warning",
 		);
-		return;
+		return false;
 	}
 	process.env.OSDY_PI_PROFILE_NAME = profile;
 	requestRender?.();
@@ -99,6 +149,7 @@ export async function switchAccountInPlace(
 		`Switched to ${profile}. Your next request uses this account.`,
 		"info",
 	);
+	return true;
 }
 
 function bundledLauncherPath(): string {
@@ -459,6 +510,31 @@ function runBundledCommand(
 	});
 }
 
+function activationFunction(value: unknown): value is (baseDir: string, profile: string) => Promise<unknown> {
+	return typeof value === "function";
+}
+
+/** Shared backend only: authentication files and launcher output never enter a view. */
+export function createAccountManagementDependencies(
+	options: AccountProfilesCommandDependencies = {},
+): AccountManagementDependencies {
+	return {
+		profiles: async () => availableProfiles(await sharedAgentDir(process.env)),
+		run: runBundledCommand,
+		activeProfile: process.env.OSDY_PI_PROFILE_NAME,
+		refreshUsage: options.refreshUsage,
+		requestRender: options.requestRender,
+		activate: async (profile) => {
+			const moduleUrl = new URL("../../scripts/osdy-pi-account-profiles.mjs", import.meta.url).href;
+			const loaded: unknown = await import(moduleUrl);
+			if (typeof loaded !== "object" || loaded === null || !("switchAccountAuth" in loaded) || !activationFunction(loaded.switchAccountAuth)) {
+				throw new Error("Account activation unavailable");
+			}
+			await loaded.switchAccountAuth(await sharedAgentDir(process.env), profile);
+		},
+	};
+}
+
 export function registerAccountProfilesCommand(
 	pi: {
 		registerCommand(
@@ -479,23 +555,7 @@ export function registerAccountProfilesCommand(
 				ctx.ui.notify("Account manager requires an interactive Pi UI.", "warning");
 				return;
 			}
-			const dependencies: AccountManagementDependencies = {
-				profiles: async () => availableProfiles(await sharedAgentDir(process.env)),
-				run: runBundledCommand,
-				activeProfile: process.env.OSDY_PI_PROFILE_NAME,
-				refreshUsage: commandDependencies.refreshUsage,
-				requestRender: commandDependencies.requestRender,
-				activate: async (profile) => {
-					const moduleUrl = new URL(
-						"../../scripts/osdy-pi-account-profiles.mjs",
-						import.meta.url,
-					).href;
-					const profiles = (await import(moduleUrl)) as {
-						switchAccountAuth(baseDir: string, name: string): Promise<void>;
-					};
-					await profiles.switchAccountAuth(await sharedAgentDir(process.env), profile);
-				},
-			};
+			const dependencies = createAccountManagementDependencies(commandDependencies);
 			if (mode === "rename" || mode === "remove") {
 				await manageAccountProfile(ctx, mode, dependencies);
 				return;

package/extensions/osdy-pi/control-center-account.test.ts

@@ -0,0 +1,241 @@
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { registerHooks } from "node:module";
+import test from "node:test";
+import type { ProfileCodexUsageResult } from "./profile-codex-usage.js";
+import { fileURLToPath } from "node:url";
+registerHooks({ resolve(specifier, context, next) {
+	if (specifier.startsWith(".") && specifier.endsWith(".js") && context.parentURL?.endsWith(".ts")) {
+		const url = new URL(`${specifier.slice(0, -3)}.ts`, context.parentURL);
+		if (existsSync(fileURLToPath(url))) return { shortCircuit: true, url: url.href };
+	}
+	return next(specifier, context);
+} });
+const { createControlCenterAccount, bindControlCenterAccount } = await import("./control-center-account.js");
+
+void test("Profile preview is explicit, independently selected and never activates", async () => {
+	const requests: string[] = [];
+	const service = createControlCenterAccount({
+		profiles: () => Promise.resolve(["work", "personal"]), active: () => "work",
+		defaultProfile: () => Promise.resolve(undefined),
+		switch: () => { throw new Error("activation forbidden"); }, setDefault: () => { throw new Error("write forbidden"); },
+		usage: profile => {
+			requests.push(profile);
+			return Promise.resolve({ status: "ready", profile, checkedAt: 1000, quotaSnapshot: { fetchedAt: 1000,
+				planType: undefined, ordinaryUsageAllowed: undefined, credits: undefined,
+				buckets: [
+					{ id: "codex", label: undefined, primary: { usedPercent: 25, windowMinutes: 300, resetsAt: 2000 }, secondary: { usedPercent: 80, windowMinutes: 10080, resetsAt: undefined } },
+					{ id: "extra", label: "Extra bucket", primary: { usedPercent: 10, windowMinutes: undefined, resetsAt: undefined }, secondary: undefined },
+				] } });
+		},
+	});
+	const initial = await service.read();
+	assert.deepEqual(requests, []);
+	assert.equal(initial.rows[0]?.label, "View usage: work");
+	assert.ok(initial.rows.findIndex(row => row.label === "View usage: personal") < initial.rows.findIndex(row => row.label === "Switch to personal"));
+	for (const profile of ["work", "personal"]) {
+		assert.equal((await service.apply({ kind: "account-usage", profile })).failed, false);
+		const row = (await service.read()).rows.find(row => row.label === `View usage: ${profile}`);
+		assert.match(row?.details?.join(" ") ?? "", /75% remaining/);
+		assert.match(row?.details?.join(" ") ?? "", /Weekly: 20% remaining.*Next reset: unknown/);
+		assert.match(row?.details?.join(" ") ?? "", /Extra bucket.*90% remaining.*Next reset: unknown/);
+		assert.ok(row?.details?.includes(`Profile: ${profile}`));
+		assert.ok(row?.details?.includes(`Checked: ${new Date(1000).toLocaleString()} (local time)`));
+		assert.ok(row?.details?.some(line => line.endsWith(`Next reset: ${new Date(2000 * 1000).toLocaleString()}`)));
+	}
+	assert.deepEqual(requests, ["work", "personal"]);
+});
+
+void test("Profile preview preserves timestamp units and marks missing or invalid resets unknown", async () => {
+	const checkedAt = 1_780_000_000_123;
+	for (const resetsAt of [1_780_000_000, 0, undefined, NaN, Infinity, -Infinity, Number.MAX_VALUE]) {
+		const service = createControlCenterAccount({
+			profiles: () => Promise.resolve(["work"]), active: () => "work",
+			defaultProfile: () => Promise.resolve(undefined),
+			switch: () => { throw new Error("activation forbidden"); },
+			setDefault: () => { throw new Error("write forbidden"); },
+			usage: profile => Promise.resolve({ status: "ready", profile, checkedAt,
+				quotaSnapshot: { fetchedAt: checkedAt, planType: undefined, ordinaryUsageAllowed: undefined, credits: undefined,
+					buckets: [{ id: "codex", label: undefined,
+						primary: { usedPercent: 25, windowMinutes: 300, resetsAt },
+						secondary: { usedPercent: 80, windowMinutes: 10080, resetsAt } }] } }),
+		});
+		await service.apply({ kind: "account-usage", profile: "work" });
+		const details = (await service.read()).rows[0]?.details ?? [];
+		assert.ok(details.includes(`Checked: ${new Date(checkedAt).toLocaleString()} (local time)`));
+		const expectedReset = resetsAt === 1_780_000_000 || resetsAt === 0
+			? new Date(resetsAt * 1000).toLocaleString() : "unknown";
+		for (const label of ["Session: 75", "Weekly: 20"]) {
+			assert.ok(details.includes(`codex / ${label}% remaining · Next reset: ${expectedReset}`));
+		}
+	}
+});
+
+void test("Account projects validated metadata, never output or credential fields", async () => {
+	const service = createControlCenterAccount({
+		profiles: () => Promise.resolve(["work", "personal", "../auth.json", { token: "secret" }]),
+		active: () => "work", defaultProfile: () => Promise.resolve({ code: 0, stdout: "personal", stderr: "secret" }),
+		switch: () => Promise.resolve(true), setDefault: () => Promise.resolve(true),
+	});
+	const view = await service.read();
+	assert.match(view.summary, /Current: work.*Default: personal/);
+	assert.equal(JSON.stringify(view).includes("secret"), false);
+	assert.equal(JSON.stringify(view).includes("auth.json"), false);
+	assert.equal(view.rows.some(row => row.label === "Switch to personal"), true);
+});
+
+void test("Account revalidates membership and uses real switch/default adapters", async () => {
+	const calls: string[] = [];
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => undefined,
+		defaultProfile: () => Promise.resolve({ code: 1, stdout: "secret", stderr: "secret" }),
+		switch: name => { calls.push(`switch:${name}`); return Promise.resolve(true); },
+		setDefault: name => { calls.push(`default:${name ?? "clear"}`); return Promise.resolve(true); },
+	});
+	assert.equal((await service.read()).summary.includes("secret"), false);
+	assert.equal((await service.apply({ kind: "account-switch", profile: "missing" })).failed, true);
+	assert.equal((await service.apply({ kind: "account-switch", profile: "work" })).failed, false);
+	assert.equal((await service.apply({ kind: "account-default", profile: "work" })).failed, false);
+	assert.deepEqual(calls, ["switch:work", "default:work"]);
+});
+
+void test("Unavailable default metadata cannot mark a profile named unavailable as default", async () => {
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["unavailable"]), active: () => undefined,
+		defaultProfile: () => Promise.resolve({ code: 1, stdout: "", stderr: "" }),
+		switch: () => Promise.resolve(true), setDefault: () => Promise.resolve(true) });
+	assert.equal((await service.read()).rows.some(row => row.current), false);
+});
+
+void test("Bound Account reuses idle switching, quota refresh, and authoritative default commands", async () => {
+	const previous = process.env.OSDY_PI_PROFILE_NAME;
+	process.env.OSDY_PI_PROFILE_NAME = "personal";
+	const events: string[] = [];
+	const commands: string[][] = [];
+	let idle = false;
+	const service = bindControlCenterAccount({ isIdle: () => idle,
+		waitForIdle: () => { events.push("idle"); idle = true; return Promise.resolve(); },
+		ui: { notify: text => events.push(text), select: () => Promise.reject(new Error("old dialog forbidden")), input: () => Promise.reject(new Error("old dialog forbidden")) } },
+		() => { events.push("refresh"); return Promise.resolve(); }, () => { events.push("render"); },
+		{ profiles: () => Promise.resolve(["work", "personal"]), activate: name => { events.push(`activate:${name}`); return Promise.resolve(); },
+			run: args => { commands.push(args); return Promise.resolve({ code: 0, stdout: "work", stderr: "secret" }); } });
+	try {
+		await service.read();
+		assert.equal((await service.apply({ kind: "account-switch", profile: "work" })).failed, false);
+		assert.deepEqual(events.slice(0, 4), ["idle", "activate:work", "render", "refresh"]);
+		assert.equal(process.env.OSDY_PI_PROFILE_NAME, "work");
+		await service.apply({ kind: "account-default", profile: "work" });
+		await service.apply({ kind: "account-default", profile: undefined });
+		assert.deepEqual(commands, [["account", "default"], ["account", "default", "work"], ["account", "default", "--clear"]]);
+		assert.equal(events.join(" ").includes("secret"), false);
+	} finally {
+		if (previous === undefined) delete process.env.OSDY_PI_PROFILE_NAME;
+		else process.env.OSDY_PI_PROFILE_NAME = previous;
+	}
+});
+
+void test("Bound Account validates live external active names without rendering unsafe metadata", async () => {
+	const previous = process.env.OSDY_PI_PROFILE_NAME;
+	const service = bindControlCenterAccount({ isIdle: () => true, waitForIdle: () => Promise.resolve(),
+		ui: { notify: () => {}, select: () => Promise.resolve(undefined), input: () => Promise.resolve(undefined) } },
+		() => Promise.resolve(), () => {},
+		{ profiles: () => Promise.resolve(["work"]), run: () => Promise.resolve({ code: 0, stdout: "No default account.", stderr: "" }) });
+	try {
+		for (const value of [undefined, "", "../auth.json", "auth.json", "DEFAULT", "token-secret\n", "x".repeat(64)]) {
+			if (value === undefined) delete process.env.OSDY_PI_PROFILE_NAME;
+			else process.env.OSDY_PI_PROFILE_NAME = value;
+			const view = await service.read();
+			assert.match(view.summary, /Current: unmanaged/);
+			assert.equal(view.rows.some(row => row.label === "Switch to work"), true);
+			assert.equal(JSON.stringify(view).includes("token-secret"), false);
+			assert.equal(JSON.stringify(view).includes("auth.json"), false);
+		}
+		process.env.OSDY_PI_PROFILE_NAME = "Work";
+		assert.match((await service.read()).summary, /Current: Work/);
+		assert.equal((await service.read()).rows.some(row => row.label === "Switch to work"), false);
+	} finally {
+		if (previous === undefined) delete process.env.OSDY_PI_PROFILE_NAME;
+		else process.env.OSDY_PI_PROFILE_NAME = previous;
+	}
+});
+
+void test("Account busy guarding rejects overlap without cancelling the first operation", async () => {
+	let finish: (value: boolean) => void = () => {};
+	let switches = 0;
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => undefined,
+		defaultProfile: () => Promise.resolve(undefined), setDefault: () => Promise.resolve(true),
+		switch: () => { switches++; return new Promise(resolve => { finish = resolve; }); } });
+	const first = service.apply({ kind: "account-switch", profile: "work" });
+	await Promise.resolve(); await Promise.resolve();
+	assert.equal((await service.apply({ kind: "account-switch", profile: "work" })).failed, true);
+	assert.equal(switches, 1); finish(true); assert.equal((await first).failed, false);
+});
+
+void test("Account errors are fixed messages and never leak backend errors", async () => {
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => "work",
+		defaultProfile: () => Promise.reject(new Error("token-secret")),
+		switch: () => Promise.reject(new Error("token-secret")), setDefault: () => Promise.resolve(false),
+	});
+	assert.equal(JSON.stringify(await service.read()).includes("token-secret"), false);
+	const result = await service.apply({ kind: "account-default", profile: "work" });
+	assert.equal(result.failed, true);
+	assert.equal(result.message.includes("token-secret"), false);
+});
+
+void test("Profile preview cancellation, supersession and stale runtime discard ignored-abort results", async () => {
+	const requests: { signal: AbortSignal; finish: (result: ProfileCodexUsageResult) => void }[] = [];
+	let current = true;
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work", "personal"]), active: () => "work",
+		defaultProfile: () => Promise.resolve(undefined), switch: () => { throw new Error("forbidden"); }, setDefault: () => { throw new Error("forbidden"); },
+		isCurrent: () => current, usage: (_profile, signal) => new Promise(finish => requests.push({ signal, finish })),
+	});
+	const flush = async () => { for (let i = 0; i < 8; i++) await Promise.resolve(); };
+	const first = service.apply({ kind: "account-usage", profile: "work" }); await flush();
+	assert.equal((await service.apply({ kind: "account-default", profile: undefined })).failed, true);
+	const second = service.apply({ kind: "account-usage", profile: "personal" }); await flush();
+	assert.equal(requests[0]?.signal.aborted, true);
+	requests[1]?.finish({ status: "unavailable", profile: "personal", checkedAt: 1000, reason: "remote-usage-unavailable" });
+	await second;
+	requests[0]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await first;
+	assert.match(JSON.stringify(await service.read()), /Remote Codex usage unavailable/);
+	assert.doesNotMatch(JSON.stringify(await service.read()), /Stored credentials unavailable \(missing/);
+	const third = service.apply({ kind: "account-usage", profile: "work" }); await flush();
+	service.cancelUsage?.(); assert.equal(requests[2]?.signal.aborted, true);
+	requests[2]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await third;
+	assert.doesNotMatch(JSON.stringify(await service.read()), /Checked:/);
+	const fourth = service.apply({ kind: "account-usage", profile: "work" }); await flush(); current = false;
+	requests[3]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await fourth;
+	assert.doesNotMatch(JSON.stringify(await service.read()), /Checked:/);
+	assert.equal((await service.apply({ kind: "account-switch", profile: "personal" })).failed, true);
+});
+
+void test("Unavailable, cancelled, absent quota and unexpected errors never fabricate zero or leak raw errors", async () => {
+	for (const outcome of ["stored-credentials-unavailable", "remote-usage-unavailable", "cancelled", "empty", "error"] as const) {
+		const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => "work",
+			defaultProfile: () => Promise.resolve(undefined), switch: () => Promise.resolve(true), setDefault: () => Promise.resolve(true),
+			usage: profile => {
+				if (outcome === "error") throw new Error("/private/auth.json token-secret");
+				if (outcome === "empty") return Promise.resolve({ status: "ready", profile, checkedAt: 1000,
+					quotaSnapshot: { fetchedAt: 1000, buckets: [], credits: undefined, planType: undefined, ordinaryUsageAllowed: undefined } });
+				if (outcome === "cancelled") return Promise.resolve({ status: "cancelled", profile, checkedAt: 1000, reason: "cancelled" });
+				return Promise.resolve({ status: "unavailable", profile, checkedAt: 1000, reason: outcome });
+			},
+		});
+		await service.apply({ kind: "account-usage", profile: "work" });
+		const text = JSON.stringify(await service.read());
+		assert.doesNotMatch(text, /0%|token-secret|private\/auth/);
+		assert.match(text, outcome === "empty" ? /unknown/ : /unavailable|cancelled/);
+	}
+});
+
+void test("Bound preview uses injected service independently of active refresh and queued stale activation", async () => {
+	let current = true; let release = () => {}; const names: string[] = [];
+	const service = bindControlCenterAccount({ isIdle: () => false, waitForIdle: () => new Promise<void>(resolve => { release = resolve; }),
+		ui: { notify: () => {}, select: () => Promise.resolve(undefined), input: () => Promise.resolve(undefined) } },
+		() => { throw new Error("active quota forbidden"); }, () => {},
+		{ profiles: () => Promise.resolve(["work"]), activate: () => { throw new Error("stale activation forbidden"); }, run: () => Promise.resolve({ code: 0, stdout: "", stderr: "" }) },
+		{ isCurrent: () => current, usage: (profile, signal) => { names.push(profile); assert.equal(signal.aborted, false);
+			return Promise.resolve({ status: "unavailable", profile, checkedAt: 1000, reason: "stored-credentials-unavailable" }); } });
+	await service.apply({ kind: "account-usage", profile: "work" }); assert.deepEqual(names, ["work"]);
+	const switching = service.apply({ kind: "account-switch", profile: "work" });
+	for (let i = 0; i < 8; i++) await Promise.resolve();
+	current = false; release(); assert.equal((await switching).failed, true);
+});