codex-usage-tracking 0.17.0__tar.gz → 0.17.2__tar.gz

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-usage-tracker",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "Unofficial local Codex usage dashboard and MCP diagnostics from local session logs.",
   "author": {
     "name": "Douglas Monsky"

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/AGENTS.md

@@ -136,6 +136,10 @@ Use patch releases for public blockers such as broken PyPI installs, missing pac
 
 Run focused tests first, then broader checks. Run the full local CI gate before opening or updating PRs that touch release, packaging, CLI contracts, MCP behavior, dashboard behavior, privacy behavior, schemas, generated docs/assets, or bundled plugin/skill files.
 
+## Source Inspection And Tool Output
+
+Large command outputs in Codex chat can be visually compacted by the transcript renderer. When inspecting source, especially after broad `rg`, `sed`, `nl`, generated dashboard assets, logs, or workflow output, do not treat a mangled rendered snippet as proof that the file is corrupt. Prefer small targeted file windows, `git diff`, `python -m py_compile`, focused tests, and CI as the source of truth. If exact syntax matters, inspect a narrow range or use a parser/compiler rather than relying on large printed source dumps.
+
 ```bash
 python -m ruff check .
 python -m mypy

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.17.2 - 2026-07-09
+
+- Add GPT-5.6 Sol, Terra, and Luna API pricing and Codex credit-rate support, including the official `gpt-5.6` alias and compatibility with OpenAI's new cache-write pricing column.
+
+## 0.17.1 - 2026-07-09
+
+- Stabilize async dogfood cache fingerprints so repeated unchanged MCP dogfood runs can reuse cached reports even when SQLite file metadata changes during read/report activity.
+
 ## 0.17.0 - 2026-07-08
 
 - Add agentic MCP investigation tools for hypothesis-driven usage diagnostics, compact evidence briefs, and actionable recommendation reports.

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-usage-tracking
-Version: 0.17.0
+Version: 0.17.2
 Summary: Unofficial local Codex plugin and dashboard for investigating aggregate token usage, costs, caching, and thread patterns.
 Author: Douglas Monsky
 License-Expression: MIT
@@ -29,8 +29,8 @@ Requires-Dist: mcp>=1.2.0
 Requires-Dist: tiktoken>=0.13.0
 Provides-Extra: dev
 Requires-Dist: agent-maintainer[core]>=0.1.0b1; python_version >= "3.11" and extra == "dev"
-Requires-Dist: actionlint-py>=1.7.12.24; python_version >= "3.11" and extra == "dev"
 Requires-Dist: build>=1.2; extra == "dev"
+Requires-Dist: check-jsonschema>=0.37.4; python_version >= "3.11" and extra == "dev"
 Requires-Dist: git-agent-ratchet>=1.3.0; python_version >= "3.11" and extra == "dev"
 Requires-Dist: mypy>=1.10; extra == "dev"
 Requires-Dist: pillow>=10; extra == "dev"
@@ -40,6 +40,7 @@ Requires-Dist: ruff>=0.8; extra == "dev"
 Requires-Dist: tach>=0.35.0; python_version >= "3.11" and extra == "dev"
 Requires-Dist: tomli>=2.0; python_version < "3.11" and extra == "dev"
 Requires-Dist: wemake-python-styleguide>=1.6.2; python_version >= "3.11" and extra == "dev"
+Requires-Dist: yamllint>=1.38.0; python_version >= "3.11" and extra == "dev"
 Requires-Dist: zizmor>=1.26.1; python_version >= "3.11" and extra == "dev"
 Dynamic: license-file
 

codex_usage_tracking-0.17.2/docs/agent-maintainer-guidance.md

@@ -0,0 +1,35 @@
+# Agent Maintainer Guidance
+
+`AGENTS.agent-maintainer.md` is generated from `[tool.agent_maintainer]` in
+`pyproject.toml` by:
+
+```bash
+python3 -m agent_maintainer guidance
+```
+
+Do not edit the generated sidecar by hand. Update configuration or the upstream
+renderer, regenerate it, and verify with:
+
+```bash
+python3 -m agent_maintainer guidance --check
+```
+
+This repo uses `legacy-ratchet` mode. Existing oversized files and structure
+warnings are tracked in `.agent-maintainer/ratchet-baseline.json` so future work
+can fail on regressions while refactor PRs reduce the baseline over time.
+
+The first aggressive refactor targets should be the largest source files named
+by:
+
+```bash
+python3 -m agent_maintainer ratchet next --limit 20
+```
+
+Use the `justfile` aliases in this repo for common verification commands:
+
+```bash
+just vp
+just v
+just vc
+just doctor
+```

codex_usage_tracking-0.17.2/docs/agent-maintainer-hardening-branch-roadmap.md

@@ -0,0 +1,116 @@
+# Agent Maintainer Hardening Branch Roadmap
+
+Branch: `refactor/secret-scan-hardening`
+
+## Goal
+
+Adopt the latest Agent Maintainer ratchet and a small set of low-noise hardening
+checks without mixing in broad Python refactors or large documentation cleanup.
+
+## Completed Chunks
+
+- Upgrade generated Agent Maintainer guidance and add local `just` wrappers.
+- Add a latest-main ratchet baseline for existing file-length and structure debt.
+- Enable configured `gitleaks` secret scanning with allowlists for ignored local
+  artifacts and intentional fake-secret fixtures.
+- Fix the publish workflow glob flagged by `actionlint`.
+- Format TOML configuration with Taplo.
+- Enable repo-configured `yamllint`.
+- Add a repo-specific Markdown lint config and enable the gate with historical
+  prose/layout rules disabled.
+- Add CI hardening job for `actionlint`, `gitleaks`, `markdownlint`,
+  `yamllint`, Taplo, and GitHub workflow schema validation.
+- Fix pytest verifier imports by including the repository root in pytest's
+  Python path.
+- Run one mechanical `ruff format` PR to clear format gate without behavior
+  changes.
+- Enable Taplo as Agent Maintainer gate after formatting TOML configuration.
+- Enable GitHub workflow schema validation with explicit `check-jsonschema`
+  arguments.
+- Re-run focused validation for the enabled optional gates.
+- Add explicit root Tach module inventory and ADR so architecture checks report
+  real dependency violations instead missing configuration.
+
+## Branch Exit
+
+This branch is ready for PR once the latest commit is pushed and CI confirms the
+same hardening gates remotely.
+
+## Follow-Up PRs
+
+### 1. Stabilize The Existing Full Profile
+
+First fix failures that prevent the full profile from being a useful signal.
+These are not product refactors; verifier hygiene should be kept in small
+mechanical PRs.
+
+- Fix narrow Pyright errors already surfaced in `cli/main.py` and
+  `context/reader.py`. These look like concrete typing issues, not broad strict
+  mode migration.
+
+### 2. Make Architecture And Dependency Checks Actionable
+
+After tests and mechanical formatting are stable, make structural gates produce
+useful review feedback.
+
+- Fix actual `tach` boundary violations only after config is explicit.
+- Triage `deptry` into three buckets: real unused dependencies, intentionally
+  optional/runtime dependencies, packaging/test-only dependencies. Commit
+  configuration only with a short explanation.
+- Triage `vulture` similarly: delete true dead code, preserve public/CLI/MCP
+  entry points with explicit allowlists, avoid broad suppressions.
+
+### 3. Security Hardening Pass
+
+Once the codebase imports and architecture checks are stable, move to security
+findings.
+
+- Triage `bandit` findings. Start with medium SQL-construction warnings and URL
+  handling; classify string-literal test fixtures separately from real issues.
+- Keep `gitleaks` enabled as the current-tree secret gate. Consider a separate
+  history-scan PR only after confirming no real credentials are present and
+  deciding how to handle historical false positives.
+- Keep `pip-audit` disabled until the project has a pinned dependency input.
+  Decide between a constraints file, lock export, or dedicated audit
+  requirements file before enabling it.
+- Triage `zizmor` with a repo-specific config/invocation. Do not enable as
+  blocking until it audits local workflows without remote-fetch failures.
+
+### 4. Ratchet Large Python Files Down
+
+After gates are trustworthy, start the actual refactor sequence. Use one PR per
+module boundary and keep behavior covered by focused tests.
+
+- Start with `src/codex_usage_tracker/cli/mcp_server.py`, because it directly
+  contributed to context/tool-output confusion and is far over the file-length
+  threshold.
+- Split `src/codex_usage_tracker/reports/api.py` by report family before editing
+  behavior; it is the largest source file in the raw baseline.
+- Split `src/codex_usage_tracker/store/content_index.py` by ingestion, FTS,
+  provenance, and query responsibilities.
+- Then address medium oversized modules surfaced by the latest file-length log:
+  `allowance_intelligence/model.py`, `server/handler.py`, diagnostics modules,
+  and CLI parser/main files.
+- Keep each refactor PR below the normal change budget unless a cohesive change
+  plan is created first.
+
+### 5. Optional Strictness Later
+
+These are useful but should wait until the above gates stop producing basic
+noise.
+
+- Tighten Markdown linting by re-enabling historical spacing/inline-HTML rules
+  only in dedicated docs cleanup PRs.
+- Consider `wemake` only after file-length and complexity ratchets have reduced
+  the largest modules.
+- Consider `interrogate` only if public API/docstring policy becomes a real
+  product requirement.
+- Consider mutation testing as a manual/release gate after core tests and
+  complexity failures are under control.
+
+## Validation
+
+- `python3 scripts/check_release.py`
+- `git diff --check`
+- `python -m agent_maintainer guidance --check`
+- Focused direct checks for each enabled optional gate.

codex_usage_tracking-0.17.2/docs/architecture/decisions/0002-explicit-tach-module-inventory.md

@@ -0,0 +1,19 @@
+# Explicit Tach Module Inventory
+
+Tach is part of the Agent Maintainer hardening profile, but the root
+`tach.toml` previously did not enumerate source modules. That made the
+architecture check too vague: Tach could run, but the verifier could not trust
+it as an explicit package-boundary contract.
+
+The root Tach config now lists each non-`__init__` Python source module under
+`src/codex_usage_tracker` as an explicit module. This is intentionally a
+baseline inventory, not a claim that all dependency edges are already healthy.
+
+Existing `tach.domain.toml` files remain the local domain-ownership notes. The
+new root module inventory gives the verifier a concrete module set so later PRs
+can address actual `tach` dependency violations incrementally instead of first
+failing on missing configuration.
+
+Follow-up work should add or reduce dependency edges in focused PRs. This
+decision does not enable circular dependency blocking or resolve existing
+architecture drift by itself.

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/docs/development.md

@@ -149,8 +149,8 @@ python scripts/smoke_installed_package.py --docker
 To verify the public PyPI package instead of the local checkout:
 
 ```bash
-python scripts/smoke_installed_package.py --from-pypi --version 0.17.0
-python scripts/smoke_installed_package.py --docker --from-pypi --version 0.17.0
+python scripts/smoke_installed_package.py --from-pypi --version 0.17.2
+python scripts/smoke_installed_package.py --docker --from-pypi --version 0.17.2
 ```
 
 `scripts/check_release.py` treats these public-package smoke commands as release-state claims. Keep their `--version` and `codex-usage-tracking==...` values aligned with `pyproject.toml`; the release gate fails when the docs claim a different public version. It also checks that install docs point at the real PyPI distribution, `codex-usage-tracking`, and keep the warning that `codex-usage-tracker` is a different PyPI package.

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/docs/one-dot-oh-readiness.md

@@ -24,12 +24,12 @@ Not guaranteed:
 
 ## 1. Public Install And Package Metadata
 
-- [x] Verify the current public PyPI version is visible as `0.17.0`: `python -c "import json, urllib.request; print(json.load(urllib.request.urlopen('https://pypi.org/pypi/codex-usage-tracking/json'))['info']['version'])"`.
-- [x] Verify public venv install for `0.17.0`: `python -m venv /tmp/codex-usage-pypi-smoke && . /tmp/codex-usage-pypi-smoke/bin/activate && python -m pip install codex-usage-tracking==0.17.0 && codex-usage-tracker --version`.
-- [x] Verify public pipx install path for `0.17.0`: `PIPX_HOME=/tmp/codex-usage-pipx-home PIPX_BIN_DIR=/tmp/codex-usage-pipx-bin pipx install codex-usage-tracking==0.17.0 && /tmp/codex-usage-pipx-bin/codex-usage-tracker --version`.
+- [x] Verify the current public PyPI version is visible as `0.17.2`: `python -c "import json, urllib.request; print(json.load(urllib.request.urlopen('https://pypi.org/pypi/codex-usage-tracking/json'))['info']['version'])"`.
+- [x] Verify public venv install for `0.17.2`: `python -m venv /tmp/codex-usage-pypi-smoke && . /tmp/codex-usage-pypi-smoke/bin/activate && python -m pip install codex-usage-tracking==0.17.2 && codex-usage-tracker --version`.
+- [x] Verify public pipx install path for `0.17.2`: `PIPX_HOME=/tmp/codex-usage-pipx-home PIPX_BIN_DIR=/tmp/codex-usage-pipx-bin pipx install codex-usage-tracking==0.17.2 && /tmp/codex-usage-pipx-bin/codex-usage-tracker --version`.
 - [x] Verify installed package resources from a built wheel: `python scripts/smoke_installed_package.py`.
 - [x] Verify installed package resources in Linux Docker: `python scripts/smoke_installed_package.py --docker`.
-- [x] Verify public PyPI package in Docker: `python scripts/smoke_installed_package.py --docker --from-pypi --version 0.17.0`.
+- [x] Verify public PyPI package in Docker: `python scripts/smoke_installed_package.py --docker --from-pypi --version 0.17.2`.
 - [x] Verify PyPI metadata names remain unchanged: `python scripts/check_release.py`.
 - [x] Add Python 3.14 as an official support target after CI, package classifiers, docs, and installed-package smoke coverage were added. Docker smoke coverage uses `python:3.14-slim` by default. Track this in issue #12.
 
@@ -134,14 +134,14 @@ Not guaranteed:
 
 ## Evidence References
 
-These references are the concrete proof behind completed checklist items. Public package smoke commands are version-specific to `0.17.0`; all repo tests use synthetic or aggregate-only data.
+These references are the concrete proof behind completed checklist items. Public package smoke commands are version-specific to `0.17.2`; all repo tests use synthetic or aggregate-only data.
 
 ### Public Install And Package Metadata
 
 - Public PyPI version, public venv install, and public pipx install are proven by the exact public-install commands in section 1.
 - Built-wheel and installed-resource coverage is proven by `scripts/smoke_installed_package.py` and `tests/test_cli_release.py::test_installed_package_smoke_checks_help_for_stable_commands`.
 - Linux package-resource coverage is proven by `scripts/smoke_installed_package.py --docker`.
-- Public PyPI Docker coverage is proven by `scripts/smoke_installed_package.py --docker --from-pypi --version 0.17.0`.
+- Public PyPI Docker coverage is proven by `scripts/smoke_installed_package.py --docker --from-pypi --version 0.17.2`.
 - PyPI metadata, package/distribution names, package resources, source/wheel member names, Python 3.10-3.14 support metadata, CI workflow requirements, publish workflow safety text, and tracked secret patterns are proven by `scripts/check_release.py`, `scripts/check_release.py --dist`, and `tests/test_cli_release.py::test_release_check_script_passes`.
 
 ### Upgrade And Migration
@@ -219,8 +219,8 @@ These references are the concrete proof behind completed checklist items. Public
 - Publish workflow package name, Trusted Publishing, TestPyPI/PyPI job presence, event guards, no push/PR publishing, no token/password publishing, and manual PyPI main/tag preflight are proven by `scripts/check_release.py::_check_publish_workflow`.
 - The GitHub `pypi` environment gate is proven by `gh api repos/douglasmonsky/codex-usage-tracker/environments/pypi`, which reports a `required_reviewers` protection rule and `can_admins_bypass=false`.
 - Dist filename and wheel/sdist member checks are proven by `python -m build`, `python -m twine check dist/*`, and `python scripts/check_release.py --dist`.
-- TestPyPI publish process is proven by a workflow-dispatch run on `main`, followed by TestPyPI metadata and clean virtualenv install checks for `codex-usage-tracking==0.17.0`.
-- PyPI publish process is proven by a workflow-dispatch run on `main`, protected `pypi` environment approval, PyPI metadata visibility, clean virtualenv install, temporary pipx install, and Docker public-package smoke for `codex-usage-tracking==0.17.0`.
+- TestPyPI publish process is proven by a workflow-dispatch run on `main`, followed by TestPyPI metadata and clean virtualenv install checks for `codex-usage-tracking==0.17.2`.
+- PyPI publish process is proven by a workflow-dispatch run on `main`, protected `pypi` environment approval, PyPI metadata visibility, clean virtualenv install, temporary pipx install, and Docker public-package smoke for `codex-usage-tracking==0.17.2`.
 - Release recovery documentation is proven by `scripts/check_release.py` required-file and docs checks.
 
 ### Known Limitations

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/docs/pricing-and-credits.md

@@ -16,6 +16,8 @@ codex-usage-tracker update-pricing
 
 This fetches OpenAI text-token pricing from `https://developers.openai.com/api/docs/pricing.md`, parses the selected tier, and writes a source-stamped local cache to `~/.codex-usage-tracker/pricing.json`. The default tier is `standard`; other supported tiers are `batch`, `flex`, and `priority`.
 
+The updater supports both the older four-value pricing rows and the newer five-value rows used by GPT-5.6 for input, cached input, cache writes, and output. GPT-5.6 Sol, Terra, and Luna are loaded from the published table, and the documented `gpt-5.6` alias resolves to `gpt-5.6-sol`. Current Codex logs do not expose a separate cache-write token counter, so cost estimates use the logged uncached input, cached input, and output counters without adding an explicit cache-write charge.
+
 If a pricing file already exists, the updater leaves a timestamped `.bak` copy next to it before replacing the active cache.
 
 The updater also includes marked best-guess estimates for Codex labels that are not finalized in the public pricing table. `codex-auto-review` uses OpenAI's published `codex-mini-latest` Codex pricing from `https://openai.com/index/introducing-codex/`: `$1.50` per 1M input tokens, a 75% prompt-cache discount (`$0.375` per 1M cached input tokens), and `$6.00` per 1M output tokens. `gpt-5.3-codex-spark` is listed by OpenAI as a research preview with non-final Codex rates, so the tracker estimates it as `gpt-5.3-codex` at `$1.75` per 1M input tokens, `$0.175` per 1M cached input tokens, and `$14.00` per 1M output tokens.
@@ -41,6 +43,8 @@ Edit `~/.codex-usage-tracker/pricing.json` with USD-per-million-token rates for
 
 `Codex Credits` is a calculated usage number, not a dashboard-only unit. The tracker uses Codex's logged aggregate token counters and the bundled OpenAI Codex rate-card snapshot to estimate credits consumed by local Codex calls.
 
+The bundled rate card includes the published GPT-5.6 Sol, Terra, and Luna credit rates from the current Codex pricing documentation.
+
 The estimate uses:
 
 - input tokens

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/docs/usage-drain-modeling.md

@@ -23,7 +23,7 @@ Sources:
 
 - [Codex Speed](https://developers.openai.com/codex/speed)
 - [Codex Pricing](https://developers.openai.com/codex/pricing)
-- [Codex rate card](https://help.openai.com/en/articles/20001106-codex-rate-card)
+- [Codex pricing and rate card](https://developers.openai.com/codex/pricing)
 - [Codex app-server](https://developers.openai.com/codex/app-server)
 - [Codex configuration reference](https://developers.openai.com/codex/config-reference)
 

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/pyproject.toml

@@ -4,16 +4,23 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-usage-tracking"
-version = "0.17.0"
+version = "0.17.2"
 description = "Unofficial local Codex plugin and dashboard for investigating aggregate token usage, costs, caching, and thread patterns."
 readme = "README.md"
 requires-python = ">=3.10"
-authors = [
-  { name = "Douglas Monsky" }
-]
+authors = [{ name = "Douglas Monsky" }]
 license = "MIT"
 license-files = ["LICENSE"]
-keywords = ["codex", "mcp", "tokens", "usage", "dashboard", "openai", "prompt-caching", "cost-analysis"]
+keywords = [
+  "codex",
+  "mcp",
+  "tokens",
+  "usage",
+  "dashboard",
+  "openai",
+  "prompt-caching",
+  "cost-analysis",
+]
 classifiers = [
   "Development Status :: 4 - Beta",
   "Environment :: Console",
@@ -29,10 +36,7 @@ classifiers = [
   "Topic :: Software Development :: Libraries :: Python Modules",
   "Topic :: System :: Monitoring",
 ]
-dependencies = [
-  "mcp>=1.2.0",
-  "tiktoken>=0.13.0"
-]
+dependencies = ["mcp>=1.2.0", "tiktoken>=0.13.0"]
 
 [project.urls]
 Homepage = "https://github.com/douglasmonsky/codex-usage-tracker"
@@ -42,19 +46,20 @@ Changelog = "https://github.com/douglasmonsky/codex-usage-tracker/blob/main/CHAN
 
 [project.optional-dependencies]
 dev = [
-    "agent-maintainer[core]>=0.1.0b1; python_version >= '3.11'",
-    "actionlint-py>=1.7.12.24; python_version >= '3.11'",
-    "build>=1.2",
-    "git-agent-ratchet>=1.3.0; python_version >= '3.11'",
-    "mypy>=1.10",
-    "pillow>=10",
-    "pytest>=8.0",
-    "pytest-cov>=5.0",
-    "ruff>=0.8",
-    "tach>=0.35.0; python_version >= '3.11'",
-    "tomli>=2.0; python_version < '3.11'",
-    "wemake-python-styleguide>=1.6.2; python_version >= '3.11'",
-    "zizmor>=1.26.1; python_version >= '3.11'",
+  "agent-maintainer[core]>=0.1.0b1; python_version >= '3.11'",
+  "build>=1.2",
+  "check-jsonschema>=0.37.4; python_version >= '3.11'",
+  "git-agent-ratchet>=1.3.0; python_version >= '3.11'",
+  "mypy>=1.10",
+  "pillow>=10",
+  "pytest>=8.0",
+  "pytest-cov>=5.0",
+  "ruff>=0.8",
+  "tach>=0.35.0; python_version >= '3.11'",
+  "tomli>=2.0; python_version < '3.11'",
+  "wemake-python-styleguide>=1.6.2; python_version >= '3.11'",
+  "yamllint>=1.38.0; python_version >= '3.11'",
+  "zizmor>=1.26.1; python_version >= '3.11'",
 ]
 
 [project.scripts]
@@ -86,7 +91,7 @@ where = ["src"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
-pythonpath = ["src"]
+pythonpath = [".", "src"]
 
 [tool.coverage.run]
 branch = true
@@ -114,12 +119,12 @@ coverage_source = ["src"]
 file_length_paths = ["src", "tests", "scripts", "skills"]
 structure_paths = ["src"]
 structure_ignore_paths = [
-    "tests/**",
-    "migrations/**",
-    "generated/**",
-    ".venv/**",
-    "venv/**",
-    "**/__pycache__/**",
+  "tests/**",
+  "migrations/**",
+  "generated/**",
+  ".venv/**",
+  "venv/**",
+  "**/__pycache__/**",
 ]
 vulture_paths = ["src", "tests"]
 require_tests = true
@@ -141,6 +146,18 @@ xenon_max_average = "A"
 ruff_max_complexity = 10
 pyright_type_checking_mode = "standard"
 enable_pip_audit = false
+enable_secret_scanning = true
+enable_yamllint = true
+enable_taplo = true
+enable_markdownlint = true
+enable_check_jsonschema = true
+check_jsonschema_args = [
+  "--builtin-schema",
+  "vendor.github-workflows",
+  ".github/workflows/ci.yml",
+  ".github/workflows/pricing-compat.yml",
+  ".github/workflows/publish.yml",
+]
 enable_wemake = false
 enable_interrogate = false
 

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/scripts/benchmark_synthetic_history.py

@@ -179,9 +179,11 @@ def main() -> int:
                 )
                 for failure in result["threshold_failures"]:
                     print(f"  FAIL {failure}")
-        return 1 if args.enforce_thresholds and any(
-            result["threshold_failures"] for result in results
-        ) else 0
+        return (
+            1
+            if args.enforce_thresholds and any(result["threshold_failures"] for result in results)
+            else 0
+        )
     finally:
         if temp_dir and not args.keep_dbs:
             shutil.rmtree(temp_dir, ignore_errors=True)
@@ -251,6 +253,7 @@ def benchmark_size(
             min_tokens=9_000,
         )
     )
+
     def payload_action() -> dict[str, Any]:
         return dashboard_payload(
             db_path=db_path,
@@ -333,9 +336,7 @@ def benchmark_size(
     }
     context_metrics: dict[str, Any] = {}
     if source_bundle:
-        timings["dashboard_payload_with_source_logs_seconds"] = (
-            dashboard_payload_active_seconds
-        )
+        timings["dashboard_payload_with_source_logs_seconds"] = dashboard_payload_active_seconds
         context_metrics = _benchmark_context_loads(
             db_path=db_path,
             row_count=row_count,
@@ -495,7 +496,9 @@ def _benchmark_context_loads(
         )
         timing_name = f"context_load_{label}_line_seconds"
         timings[timing_name] = elapsed
-        diagnostics = payload.get("diagnostics") if isinstance(payload.get("diagnostics"), dict) else {}
+        diagnostics = (
+            payload.get("diagnostics") if isinstance(payload.get("diagnostics"), dict) else {}
+        )
         loads[label] = {
             "record_id": record_id,
             "seconds": elapsed,
@@ -534,10 +537,7 @@ def _evaluate_thresholds(
         if threshold is None:
             continue
         limit = round(
-            (
-                threshold["base_seconds"]
-                + threshold["per_10k_seconds"] * (row_count / 10_000)
-            )
+            (threshold["base_seconds"] + threshold["per_10k_seconds"] * (row_count / 10_000))
             * threshold_scale,
             6,
         )
@@ -818,9 +818,15 @@ def _synthetic_events(
             subagent_type="guardian" if is_review else "thread_spawn" if is_subagent else None,
             agent_role="reviewer" if is_review else "worker" if is_subagent else None,
             agent_nickname=None,
-            parent_session_id=f"session-{(index - 1) % 2500:04d}" if is_subagent or is_review else None,
-            parent_thread_name=_synthetic_thread_name(index - 1) if is_subagent or is_review else None,
-            parent_session_updated_at=f"2026-05-{day:02d}T22:00:00Z" if is_subagent or is_review else None,
+            parent_session_id=f"session-{(index - 1) % 2500:04d}"
+            if is_subagent or is_review
+            else None,
+            parent_thread_name=_synthetic_thread_name(index - 1)
+            if is_subagent or is_review
+            else None,
+            parent_session_updated_at=f"2026-05-{day:02d}T22:00:00Z"
+            if is_subagent or is_review
+            else None,
             model_context_window=200_000,
             input_tokens=metrics["input_tokens"],
             cached_input_tokens=metrics["cached_input_tokens"],

{codex_usage_tracking-0.17.0 → codex_usage_tracking-0.17.2}/scripts/check_release.py

@@ -266,10 +266,7 @@ def main() -> int:
 
 def _check_required_files() -> list[str]:
     failures: list[str] = []
-    tracked_files = {
-        path.relative_to(REPO_ROOT).as_posix()
-        for path in _tracked_files()
-    }
+    tracked_files = {path.relative_to(REPO_ROOT).as_posix() for path in _tracked_files()}
     for path in REQUIRED_FILES:
         if not (REPO_ROOT / path).exists():
             failures.append(f"missing required file: {path}")
@@ -337,7 +334,9 @@ def _check_package_naming_docs() -> list[str]:
     for relative_path in PACKAGE_NAMING_DOCS:
         text = (REPO_ROOT / relative_path).read_text(encoding="utf-8")
         if DISTRIBUTION_NAME not in text:
-            failures.append(f"{relative_path} must name the public PyPI package {DISTRIBUTION_NAME}")
+            failures.append(
+                f"{relative_path} must name the public PyPI package {DISTRIBUTION_NAME}"
+            )
         if relative_path in {"README.md", "docs/install.md"} and old_name_warning not in text:
             failures.append(
                 f"{relative_path} must warn that {OLD_PYPI_DISTRIBUTION_NAME} "
@@ -406,9 +405,11 @@ def _check_packaging_metadata() -> list[str]:
     failures: list[str] = []
     manifest = json.loads((REPO_ROOT / ".codex-plugin/plugin.json").read_text(encoding="utf-8"))
     if manifest != plugin_manifest():
-        failures.append(".codex-plugin/plugin.json does not match plugin_installer.plugin_manifest()")
+        failures.append(
+            ".codex-plugin/plugin.json does not match plugin_installer.plugin_manifest()"
+        )
     if project.get("license") != "MIT":
-        failures.append("pyproject.toml should use SPDX license = \"MIT\"")
+        failures.append('pyproject.toml should use SPDX license = "MIT"')
     if "license-files" not in project:
         failures.append("pyproject.toml should include license-files")
     if "urls" not in project:
@@ -427,7 +428,9 @@ def _check_packaging_metadata() -> list[str]:
     if mcp_server.get("args") != ["./skills/codex-usage-tracker/scripts/run_mcp.py"]:
         failures.append(".mcp.json should point at the bundled MCP bootstrap launcher")
     if mcp_server.get("startup_timeout_sec") != 120:
-        failures.append(".mcp.json should allow enough startup time for first-run runtime bootstrap")
+        failures.append(
+            ".mcp.json should allow enough startup time for first-run runtime bootstrap"
+        )
     manifest = (REPO_ROOT / "MANIFEST.in").read_text(encoding="utf-8")
     if "recursive-include skills *.md *.py" not in manifest:
         failures.append("MANIFEST.in should include Codex skill scripts in the source distribution")
@@ -453,7 +456,9 @@ def _check_packaging_metadata() -> list[str]:
     if "importlib.metadata.version('codex-usage-tracking')" not in launcher:
         failures.append("MCP runtime launcher must check the codex-usage-tracking distribution")
     if "PACKAGE_SPEC_MARKER" not in launcher:
-        failures.append("MCP runtime launcher should invalidate cached runtimes when package spec changes")
+        failures.append(
+            "MCP runtime launcher should invalidate cached runtimes when package spec changes"
+        )
     failures.extend(_check_python_support_metadata(project))
     failures.extend(_check_ci_workflow())
     failures.extend(_check_publish_workflow())
@@ -506,8 +511,8 @@ def _check_publish_workflow() -> list[str]:
         "python -m twine check dist/*",
         "if: github.event_name == 'workflow_dispatch' && inputs.target == 'testpypi'",
         "if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.target == 'pypi')",
-        "echo \"ref=$GITHUB_REF\"",
-        "echo \"sha=$GITHUB_SHA\"",
+        'echo "ref=$GITHUB_REF"',
+        'echo "sha=$GITHUB_SHA"',
         "refs/heads/main|refs/tags/*",
         "Manual PyPI publishing must run from main or a tag ref.",
         "name: testpypi",
@@ -518,7 +523,9 @@ def _check_publish_workflow() -> list[str]:
         "codex-usage-tracking {version} already exists on {index_name}; skipping upload.",
     ]:
         if required not in workflow:
-            failures.append(f"publish workflow is missing required Trusted Publishing text: {required}")
+            failures.append(
+                f"publish workflow is missing required Trusted Publishing text: {required}"
+            )
     if re.search(r"(?m)^\s*push\s*:", workflow):
         failures.append("publish workflow must not publish on ordinary pushes")
     if re.search(r"(?m)^\s*pull_request\s*:", workflow):
@@ -532,9 +539,9 @@ def _check_publish_workflow() -> list[str]:
             continue
         for required in [
             "Verify PyPI publish ref",
-            "echo \"event=$GITHUB_EVENT_NAME\"",
-            "echo \"ref=$GITHUB_REF\"",
-            "echo \"sha=$GITHUB_SHA\"",
+            'echo "event=$GITHUB_EVENT_NAME"',
+            'echo "ref=$GITHUB_REF"',
+            'echo "sha=$GITHUB_SHA"',
             "refs/heads/main|refs/tags/*",
             "Manual PyPI publishing must run from main or a tag ref.",
             "Check target package version",
@@ -578,7 +585,9 @@ def _check_ci_workflow() -> list[str]:
 def _check_skill_packaging() -> list[str]:
     failures: list[str] = []
     pyproject = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8"))
-    package_data = set(pyproject["tool"]["setuptools"]["package-data"]["codex_usage_tracker.plugin_data"])
+    package_data = set(
+        pyproject["tool"]["setuptools"]["package-data"]["codex_usage_tracker.plugin_data"]
+    )
     if "dashboard/locales/*" not in package_data:
         failures.append("pyproject.toml package data is missing dashboard locale catalogs")
     for source_skill in sorted((REPO_ROOT / "skills").glob("*/SKILL.md")):