pi-codex-accounts 0.0.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tiago Peixoto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,4 +1,59 @@
 # pi-codex-accounts
 
-This version only reserves the package name.
-Install 0.1.0 or later: https://github.com/tiago-peixoto/pi-codex-accounts
+Use more than one ChatGPT (Codex) subscription in [pi](https://pi.dev), each with its own login and its own entries in `/model`.
+
+pi's built-in OpenAI Codex provider holds one login.
+This extension adds providers that work exactly like it, so a second (or third) ChatGPT account can stay signed in next to the first:
+
+```text
+gpt-5.6-sol [openai-codex]
+gpt-5.6-sol [openai-codex-2]
+```
+
+It never switches accounts on its own.
+You choose the account whenever you choose a model.
+
+## Install
+
+```sh
+pi install npm:pi-codex-accounts
+```
+
+Then run `/login`, choose **Sign in with an account**, pick **OpenAI Codex (2)**, and sign in with your other ChatGPT account.
+Your browser may reuse the ChatGPT account it is already signed into, so use a private window or the device-code option.
+
+## More accounts or other names
+
+Create `~/.pi/agent/codex-accounts.json` and restart pi:
+
+```json
+{ "accounts": ["Work", "Personal"] }
+```
+
+Each label becomes a provider: `Work` shows up as **OpenAI Codex (Work)** with the id `openai-codex-work`.
+Without the file you get one extra account, `openai-codex-2`.
+An empty list adds none.
+pi stores logins under the provider id, so renaming a label means signing in again.
+
+## How it works
+
+Each account reuses pi's own Codex login flow, model list, and request code, so it behaves like the built-in provider and picks up new Codex models when pi updates.
+pi keeps each login in `~/.pi/agent/auth.json` under the account's provider id, and requests use that login's token.
+
+Two details keep accounts apart:
+
+- pi-ai's Codex code keeps Responses tool-call ids intact only for the provider id `openai-codex`, so requests go out under that id and replies are relabelled with the account's id.
+- Replies from a different Codex account in the same session count as another provider's, so their encrypted reasoning is dropped instead of being sent to this account.
+
+The extension never copies tokens into environment variables, so commands the agent runs cannot read them.
+
+Tested with pi 0.85.1.
+
+## Development
+
+```sh
+npm install
+npm test
+```
+
+Releases are built by GitHub Actions and published with npm trusted publishing, so every version on npm links back to the commit it was built from.

package/package.json

@@ -1,10 +1,41 @@
 {
   "name": "pi-codex-accounts",
-  "version": "0.0.0",
-  "description": "Placeholder that reserves the package name. Install 0.1.0 or later.",
+  "version": "0.1.1",
+  "description": "Use more than one ChatGPT (Codex) subscription in pi, each with its own login and its own entries in /model.",
+  "keywords": [
+    "pi-package",
+    "pi",
+    "pi-extension",
+    "codex",
+    "openai",
+    "chatgpt"
+  ],
   "license": "MIT",
+  "author": "Tiago Peixoto",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/tiago-peixoto/pi-codex-accounts.git"
+  },
+  "type": "module",
+  "files": [
+    "src"
+  ],
+  "pi": {
+    "extensions": [
+      "./src/index.ts"
+    ]
+  },
+  "scripts": {
+    "test": "tsc && node --test test/index.test.ts && sh scripts/smoke.sh"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "0.85.1",
+    "@earendil-works/pi-coding-agent": "0.85.1",
+    "@types/node": "22.20.2",
+    "typescript": "7.0.2"
   }
 }

package/src/index.ts

@@ -0,0 +1,143 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+	type AssistantMessageEvent,
+	type AssistantMessageEventStream,
+	type Context,
+	createAssistantMessageEventStream,
+	type Model,
+	type Provider,
+} from "@earendil-works/pi-ai";
+import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
+import { type ExtensionAPI, getAgentDir } from "@earendil-works/pi-coding-agent";
+
+const CODEX = "openai-codex";
+const CONFIG_FILE = "codex-accounts.json";
+
+type CodexApi = "openai-codex-responses";
+
+export interface Account {
+	id: string;
+	name: string;
+}
+
+export default function codexAccounts(pi: ExtensionAPI) {
+	const path = join(getAgentDir(), CONFIG_FILE);
+	let accounts: Account[];
+	try {
+		accounts = parseAccounts(readConfig(path));
+	} catch (error) {
+		throw new Error(`${path}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const codex = builtinCodexProvider();
+	for (const account of accounts) pi.registerProvider(createAccountProvider(codex, account));
+}
+
+/** pi lets extensions import only a few pi-ai entry points; providers/all is the one with the built-in providers. */
+export function builtinCodexProvider(): Provider<CodexApi> {
+	const codex = builtinProviders().find((provider) => provider.id === CODEX);
+	if (!codex) throw new Error("pi no longer ships a built-in OpenAI Codex provider");
+	return codex as Provider<CodexApi>;
+}
+
+/** The config file's text, or undefined when there is no config file. */
+function readConfig(path: string): string | undefined {
+	try {
+		return readFileSync(path, "utf8");
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+		throw error;
+	}
+}
+
+/** Without a config file there is one extra account, labelled "2". */
+export function parseAccounts(json: string | undefined): Account[] {
+	const labels = json === undefined ? ["2"] : readLabels(json);
+	const accounts = labels.map((label) => ({ id: `${CODEX}-${slug(label)}`, name: `OpenAI Codex (${label.trim()})` }));
+	const seen = new Set<string>();
+	for (const { id } of accounts) {
+		if (seen.has(id)) throw new Error(`two labels turn into the same provider id "${id}"`);
+		seen.add(id);
+	}
+	return accounts;
+}
+
+function readLabels(json: string): string[] {
+	const labels = (JSON.parse(json) as { accounts?: unknown } | null)?.accounts;
+	if (!Array.isArray(labels) || !labels.every((label) => typeof label === "string" && slug(label) !== "")) {
+		throw new Error('expected {"accounts": ["Work", "Personal"]}, with an ASCII letter or digit in each label');
+	}
+	return labels;
+}
+
+function slug(label: string): string {
+	return label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+
+/**
+ * The built-in Codex provider under another id, so pi keeps a separate login for it
+ * and lists its models separately in /model.
+ */
+export function createAccountProvider(codex: Provider<CodexApi>, account: Account): Provider<CodexApi> {
+	const oauth = codex.auth.oauth;
+	if (!oauth) throw new Error("pi's built-in OpenAI Codex provider no longer offers a ChatGPT login");
+	const models = codex.getModels().map((model) => ({ ...model, provider: account.id }));
+	return {
+		id: account.id,
+		name: account.name,
+		baseUrl: codex.baseUrl,
+		headers: codex.headers,
+		// Only the login: any other auth the built-in provider may gain (an environment variable, say)
+		// would resolve to the built-in account instead of this one.
+		auth: { oauth: { ...oauth, name: account.name } },
+		getModels: () => models,
+		// pi-ai's Codex API keeps Responses tool-call ids ("call|item") intact only when the model's
+		// provider is "openai-codex", so requests go out under that id and replies are relabelled.
+		stream: (model, context, options) =>
+			withProvider(codex.stream(asCodex(model), asCodexContext(context, account.id), options), account.id),
+		streamSimple: (model, context, options) =>
+			withProvider(codex.streamSimple(asCodex(model), asCodexContext(context, account.id), options), account.id),
+	};
+}
+
+function asCodex<T extends CodexApi>(model: Model<T>): Model<T> {
+	return { ...model, provider: CODEX };
+}
+
+/**
+ * Marks this account's earlier replies as "openai-codex" so the Codex API treats them as the same
+ * conversation. Replies from every other Codex account, the built-in one included, get a different id,
+ * so their encrypted reasoning is dropped instead of being sent to this account.
+ */
+export function asCodexContext(context: Context, accountId: string): Context {
+	return {
+		...context,
+		messages: context.messages.map((message) => {
+			if (message.role !== "assistant") return message;
+			if (message.provider === accountId) return { ...message, provider: CODEX };
+			if (message.provider === CODEX) return { ...message, provider: `${CODEX} (another account)` };
+			return message;
+		}),
+	};
+}
+
+/** Copies each event with the account's id. The Codex API keeps using its own message objects, so they stay untouched. */
+export function withProvider(inner: AssistantMessageEventStream, provider: string): AssistantMessageEventStream {
+	const outer = createAssistantMessageEventStream();
+	void (async () => {
+		for await (const event of inner) outer.push(relabel(event, provider));
+		outer.end();
+	})();
+	return outer;
+}
+
+function relabel(event: AssistantMessageEvent, provider: string): AssistantMessageEvent {
+	switch (event.type) {
+		case "done":
+			return { ...event, message: { ...event.message, provider } };
+		case "error":
+			return { ...event, error: { ...event.error, provider } };
+		default:
+			return { ...event, partial: { ...event.partial, provider } };
+	}
+}