overkill 0.7.0__tar.gz → 0.8.2__tar.gz

{overkill-0.7.0 → overkill-0.8.2}/.overkillrc.example

@@ -17,6 +17,14 @@
 # Enable auto-commit of fixes (default: true)
 # AUTO_COMMIT=true
 
+# CI trigger policy for iteration commits (default: last-only)
+#   last-only — append "[skip ci]" to each iteration commit; push a single
+#               empty "chore: trigger CI" commit only when the loop ends
+#               with all_clear (saves CI cost on long iteration runs)
+#   every     — each iteration commit triggers CI (pre-0.3 behaviour)
+#   none      — append "[skip ci]"; no trigger commit (forks / CI-less repos)
+# CI_TRIGGER_MODE="last-only"
+
 # Path to active prompt templates (default: <script_dir>/../prompts/active)
 # PROMPTS_DIR="./custom-prompts"
 
@@ -30,6 +38,12 @@
 # Pre-flight budget check scope: micro (<90%) or module (<75%) (default: module)
 # BUDGET_SCOPE="module"
 
+# ── Budget Gate ─────────────────────────────────────────────────────
+# Skip token-budget checks entirely. Use when local budget data is stale or
+# wrong (e.g. Codex session logs left over from a previous login).
+# Equivalent to --no-budget-gate / OVERKILL_SKIP_BUDGET=1. (default: false)
+# NO_BUDGET_GATE=false
+
 # ── Diagnostic Logging ──────────────────────────────────────────────
 # Save full Claude event stream (tool calls, reasoning) to .stream.jsonl files.
 # Useful for debugging missed findings. (default: false)

{overkill-0.7.0 → overkill-0.8.2}/.refactorsuggestrc.example

@@ -44,6 +44,12 @@
 # Pre-flight budget check scope: micro (<90%) or module (<75%) (default: module)
 # BUDGET_SCOPE="module"
 
+# ── Budget Gate ─────────────────────────────────────────────────────
+# Skip token-budget checks entirely. Use when local budget data is stale or
+# wrong (e.g. Codex session logs left over from a previous login).
+# Equivalent to --no-budget-gate / OVERKILL_SKIP_BUDGET=1. (default: false)
+# NO_BUDGET_GATE=false
+
 # ── Diagnostic Logging ──────────────────────────────────────────────
 # Save full Claude event stream (tool calls, reasoning) to .stream.jsonl files.
 # Useful for debugging missed findings. (default: false)

{overkill-0.7.0 → overkill-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: overkill
-Version: 0.7.0
+Version: 0.8.2
 Summary: AI-powered code review loop — automates Codex/Gemini review + Claude fix cycles
 Project-URL: Repository, https://github.com/modocai/mr-overkill
 Project-URL: Issues, https://github.com/modocai/mr-overkill/issues
@@ -125,7 +125,14 @@ Options:
   --no-auto-commit         Fix but do not commit/push (single iteration)
   --resume                 Resume from a previously interrupted run (reuses existing logs)
   --reviewer-backend <be>  Reviewer backend: claude|codex (default: codex)
+  --ci-trigger-mode <m>    CI trigger policy: every|last-only|none (default: last-only).
+                           'last-only' tags each iteration commit with [skip ci]
+                           and pushes a single empty trigger commit on PASS —
+                           CI runs once instead of once per iteration.
+                           Use 'every' to restore pre-0.3 per-commit CI.
   --diagnostic-log         Save full Claude event stream to sidecar files
+  --no-budget-gate         Skip token-budget checks and run regardless
+                           (same as OVERKILL_SKIP_BUDGET=1)
 
 Examples:
   overkill review-loop -t main -n 3          # diff against main, max 3 loops
@@ -134,6 +141,7 @@ Examples:
   overkill review-loop -n 3 --no-self-review # disable self-review sub-loop
   overkill review-loop --resume              # resume an interrupted run
   overkill review-loop -n 2 --reviewer-backend claude  # use Claude as reviewer
+  overkill review-loop -n 10 --ci-trigger-mode last-only  # CI fires once on PASS
 ```
 
 ## Usage: overkill refactor-suggest
@@ -158,6 +166,8 @@ Options:
   --with-review-loops <N>  Set review-loop iteration count (implies --with-review)
   --reviewer-backend <be>  Reviewer backend: claude|codex (default: codex)
   --diagnostic-log         Save full Claude event stream to sidecar files
+  --no-budget-gate         Skip token-budget checks and run regardless
+                           (same as OVERKILL_SKIP_BUDGET=1)
 
 Examples:
   overkill refactor-suggest -n 3                             # auto scope (budget-aware)
@@ -304,6 +314,13 @@ All logs are git-ignored by default (inside `.overkill/`).
 
 The budget checker verifies Claude Code's 5-hour rate limit **before** starting expensive loops.
 
+Codex is checked too, but only when it authenticates through a ChatGPT plan.
+Auth mode is read from `$CODEX_HOME/auth.json` (default `~/.codex/auth.json`),
+falling back to the login method in `config.toml` when Codex keeps credentials
+in the OS keyring instead; under API-key auth there are no plan rate-limit
+windows, so the gate is skipped entirely and stale session logs from a previous
+plan login are ignored.
+
 ### How it estimates usage
 
 | Mode | Data source | Accuracy |
@@ -324,6 +341,18 @@ Go/no-go decision based on current usage percentage:
 | `layer` | TBD | Cross-cutting changes |
 | `full` | TBD | Full architecture review |
 
+### Bypassing the gate
+
+Budget data is an estimate read from local CLI logs, so it can be wrong — stale
+logs, a changed auth mode, or a new rate-limit payload shape. To run anyway:
+
+```bash
+overkill review-loop -n 3 --no-budget-gate   # per run
+OVERKILL_SKIP_BUDGET=1 overkill review-loop -n 3   # env var, covers every gate
+```
+
+`NO_BUDGET_GATE=true` in `.overkillrc` / `.refactorsuggestrc` makes it the default.
+
 ## Customizing Prompts
 
 Edit the templates in `.overkill/prompts/active/`.

{overkill-0.7.0 → overkill-0.8.2}/README.md

@@ -102,7 +102,14 @@ Options:
   --no-auto-commit         Fix but do not commit/push (single iteration)
   --resume                 Resume from a previously interrupted run (reuses existing logs)
   --reviewer-backend <be>  Reviewer backend: claude|codex (default: codex)
+  --ci-trigger-mode <m>    CI trigger policy: every|last-only|none (default: last-only).
+                           'last-only' tags each iteration commit with [skip ci]
+                           and pushes a single empty trigger commit on PASS —
+                           CI runs once instead of once per iteration.
+                           Use 'every' to restore pre-0.3 per-commit CI.
   --diagnostic-log         Save full Claude event stream to sidecar files
+  --no-budget-gate         Skip token-budget checks and run regardless
+                           (same as OVERKILL_SKIP_BUDGET=1)
 
 Examples:
   overkill review-loop -t main -n 3          # diff against main, max 3 loops
@@ -111,6 +118,7 @@ Examples:
   overkill review-loop -n 3 --no-self-review # disable self-review sub-loop
   overkill review-loop --resume              # resume an interrupted run
   overkill review-loop -n 2 --reviewer-backend claude  # use Claude as reviewer
+  overkill review-loop -n 10 --ci-trigger-mode last-only  # CI fires once on PASS
 ```
 
 ## Usage: overkill refactor-suggest
@@ -135,6 +143,8 @@ Options:
   --with-review-loops <N>  Set review-loop iteration count (implies --with-review)
   --reviewer-backend <be>  Reviewer backend: claude|codex (default: codex)
   --diagnostic-log         Save full Claude event stream to sidecar files
+  --no-budget-gate         Skip token-budget checks and run regardless
+                           (same as OVERKILL_SKIP_BUDGET=1)
 
 Examples:
   overkill refactor-suggest -n 3                             # auto scope (budget-aware)
@@ -281,6 +291,13 @@ All logs are git-ignored by default (inside `.overkill/`).
 
 The budget checker verifies Claude Code's 5-hour rate limit **before** starting expensive loops.
 
+Codex is checked too, but only when it authenticates through a ChatGPT plan.
+Auth mode is read from `$CODEX_HOME/auth.json` (default `~/.codex/auth.json`),
+falling back to the login method in `config.toml` when Codex keeps credentials
+in the OS keyring instead; under API-key auth there are no plan rate-limit
+windows, so the gate is skipped entirely and stale session logs from a previous
+plan login are ignored.
+
 ### How it estimates usage
 
 | Mode | Data source | Accuracy |
@@ -301,6 +318,18 @@ Go/no-go decision based on current usage percentage:
 | `layer` | TBD | Cross-cutting changes |
 | `full` | TBD | Full architecture review |
 
+### Bypassing the gate
+
+Budget data is an estimate read from local CLI logs, so it can be wrong — stale
+logs, a changed auth mode, or a new rate-limit payload shape. To run anyway:
+
+```bash
+overkill review-loop -n 3 --no-budget-gate   # per run
+OVERKILL_SKIP_BUDGET=1 overkill review-loop -n 3   # env var, covers every gate
+```
+
+`NO_BUDGET_GATE=true` in `.overkillrc` / `.refactorsuggestrc` makes it the default.
+
 ## Customizing Prompts
 
 Edit the templates in `.overkill/prompts/active/`.

{overkill-0.7.0 → overkill-0.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "overkill"
-version = "0.7.0"
+version = "0.8.2"
 description = "AI-powered code review loop — automates Codex/Gemini review + Claude fix cycles"
 readme = "README.md"
 license = { text = "MIT" }

{overkill-0.7.0 → overkill-0.8.2}/src/mr_overkill/__main__.py

@@ -85,11 +85,14 @@ def main() -> None:
             from mr_overkill.cli import parse_review_loop_args
             from mr_overkill.review_loop import run as review_run
 
-            review_config = parse_review_loop_args([
+            review_argv = [
                 "-t", config.target_branch,
                 "-n", str(extra.review_loops),
                 "--reviewer-backend", config.reviewer_backend,
-            ])
+            ]
+            if config.skip_budget_gate:
+                review_argv.append("--no-budget-gate")
+            review_config = parse_review_loop_args(review_argv)
             exit_code = review_run(review_config)
         sys.exit(exit_code)
     elif command == "check-budget":

{overkill-0.7.0 → overkill-0.8.2}/src/mr_overkill/agents.py

@@ -16,6 +16,7 @@ from abc import ABC, abstractmethod
 from importlib.resources import as_file, files
 from pathlib import Path
 
+from mr_overkill.budget import SKIP_BUDGET_ENV_VAR, budget_gate_disabled
 from mr_overkill.budget.claude import claude_budget_sufficient
 from mr_overkill.budget.codex import codex_budget_sufficient
 from mr_overkill.budget.gemini import gemini_budget_sufficient
@@ -88,6 +89,13 @@ def _budget_check(
     tool: str, scope: BudgetScope, max_wait: int
 ) -> bool:
     """Direct budget check without waiting."""
+    if budget_gate_disabled():
+        logger.info(
+            "Budget gate disabled via %s — skipping %s check.",
+            SKIP_BUDGET_ENV_VAR,
+            tool,
+        )
+        return True
     if tool == "claude":
         return claude_budget_sufficient(scope)
     if tool == "codex":
@@ -109,6 +117,12 @@ class _BudgetFn:
     def __call__(
         self, tool: str, scope: BudgetScope, max_wait: int
     ) -> bool:
+        if self._config.skip_budget_gate:
+            logger.info(
+                "Budget gate disabled (--no-budget-gate) — running %s anyway.",
+                tool,
+            )
+            return True
         actual = (
             max_wait if max_wait > 0 else self._config.retry_max_wait
         )

{overkill-0.7.0 → overkill-0.8.2}/src/mr_overkill/budget/__init__.py

@@ -7,6 +7,7 @@ Ports ``_budget_sufficient`` from ``common.sh`` and
 from __future__ import annotations
 
 import logging
+import os
 
 from mr_overkill.models import BudgetScope, BudgetStatus
 from mr_overkill.time_utils import codex_ts_to_iso
@@ -21,6 +22,28 @@ _THRESHOLDS: dict[BudgetScope, int | None] = {
     BudgetScope.FULL: None,
 }
 
+# Rate-limit window kinds, keyed by the field they map onto in BudgetStatus.
+FIVE_HOUR_WINDOW = "five_hour"
+SEVEN_DAY_WINDOW = "seven_day"
+
+# Any window declared as one day or shorter counts as the short ("5-hour")
+# window; anything longer is the rolling weekly window.
+_SHORT_WINDOW_MAX_MINUTES = 24 * 60
+
+# Env escape hatch: set to 1/true/yes/on to bypass every budget gate.
+SKIP_BUDGET_ENV_VAR = "OVERKILL_SKIP_BUDGET"
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+
+
+def budget_gate_disabled() -> bool:
+    """Return True if the user has disabled budget gating via the environment.
+
+    Local budget data is an estimate derived from CLI logs; when it is wrong
+    (stale logs, changed auth mode, new rate-limit shapes) the loop would
+    otherwise block with no way out.
+    """
+    return os.environ.get(SKIP_BUDGET_ENV_VAR, "").strip().lower() in _TRUTHY
+
 
 def has_threshold(scope: BudgetScope) -> bool:
     """Return True if *scope* has a defined go/no-go threshold."""
@@ -73,6 +96,36 @@ def budget_sufficient(scope: BudgetScope, status: BudgetStatus) -> bool:
     return False
 
 
+def codex_window_kind(window: dict[str, object] | None) -> str | None:
+    """Classify a Codex ``rate_limits`` window by its declared length.
+
+    Codex does not guarantee that ``primary`` is the short window — on some
+    plans ``primary`` carries the weekly (``window_minutes: 10080``) limit.
+    Returns ``None`` when the window omits ``window_minutes``, leaving the
+    caller to fall back to positional assignment.
+    """
+    if not window:
+        return None
+
+    raw = window.get("window_minutes")
+    if raw is None:
+        return None
+
+    try:
+        minutes = float(str(raw))
+    except ValueError:
+        return None
+
+    if minutes <= 0:
+        return None
+
+    return (
+        FIVE_HOUR_WINDOW
+        if minutes <= _SHORT_WINDOW_MAX_MINUTES
+        else SEVEN_DAY_WINDOW
+    )
+
+
 def codex_parse_window(
     window: dict[str, object] | None,
     now_epoch: int,

overkill-0.8.2/src/mr_overkill/budget/codex.py

@@ -0,0 +1,300 @@
+"""Codex CLI token-budget checker.
+
+Ports the five functions from ``check-codex-limit.sh``:
+find_latest_token_count, check_token_budget, codex_budget_sufficient.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import tomllib
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+
+from mr_overkill.budget import (
+    FIVE_HOUR_WINDOW,
+    SEVEN_DAY_WINDOW,
+    budget_sufficient,
+    codex_parse_window,
+    codex_window_kind,
+)
+from mr_overkill.models import BudgetScope, BudgetStatus
+
+logger = logging.getLogger(__name__)
+
+# Codex auth modes, as written to ``auth.json`` by ``codex login``.
+AUTH_MODE_APIKEY = "apikey"
+AUTH_MODE_CHATGPT = "chatgpt"
+AUTH_MODE_UNKNOWN = "unknown"
+
+# ``config.toml`` keys that record the login method Codex was set up with.
+# Only ``forced_login_method`` is read: the older ``preferred_auth_method`` is
+# gone from current Codex, which silently ignores it, so a stale copy left in a
+# config would misreport the login Codex actually uses.
+_CONFIG_AUTH_KEYS = ("forced_login_method",)
+
+# Login-method spellings seen across auth.json and config.toml, mapped to the
+# canonical mode the budget gate compares against.  ``api`` is the only value
+# current Codex accepts for ``forced_login_method`` — it rejects the ``apikey``
+# spellings outright — while auth.json writes ``apikey``.
+_AUTH_MODE_ALIASES = {
+    "api": AUTH_MODE_APIKEY,
+    "apikey": AUTH_MODE_APIKEY,
+    "api_key": AUTH_MODE_APIKEY,
+    "api-key": AUTH_MODE_APIKEY,
+    "chatgpt": AUTH_MODE_CHATGPT,
+}
+
+
+def codex_home() -> Path:
+    """Return the Codex config directory (``$CODEX_HOME`` or ``~/.codex``)."""
+    raw = os.environ.get("CODEX_HOME", "").strip()
+    return Path(raw) if raw else Path.home() / ".codex"
+
+
+def _config_auth_mode(home: Path) -> str | None:
+    """Return the login method declared in ``config.toml``, or ``None``.
+
+    Only recognised spellings are reported, so ``None`` means "the config
+    declares no login method we know" — which is what lets the caller tell an
+    explicit ChatGPT setup apart from a config that says nothing at all.
+    """
+    try:
+        with (home / "config.toml").open("rb") as handle:
+            config = tomllib.load(handle)
+    except (OSError, ValueError):
+        # ValueError covers both TOMLDecodeError and the UnicodeDecodeError
+        # tomllib raises when it decodes the bytes itself.
+        return None
+
+    for key in _CONFIG_AUTH_KEYS:
+        value = config.get(key)
+        if isinstance(value, str):
+            mode = _AUTH_MODE_ALIASES.get(value.strip().lower())
+            if mode is not None:
+                return mode
+
+    return None
+
+
+def detect_auth_mode(home: Path | None = None) -> str:
+    """Detect how the Codex CLI authenticates.
+
+    ``CODEX_API_KEY`` wins outright: Codex sends it even when ``auth.json``
+    holds a ChatGPT login.  Otherwise ``auth.json`` is authoritative, since it
+    records the mode chosen by the last ``codex login``.  Falls back to the
+    login method declared in ``config.toml``, then to ``unknown``.
+
+    Only reads what is already on disk.  Logins this cannot name — credentials
+    kept in the OS keyring, Bedrock, access tokens — come back ``unknown``,
+    which leaves the plan gate active.  That is deliberate rather than a gap:
+    a login with no plan windows reports no usage either, so the gate finds no
+    data and lets the run through anyway.  The only setup it actually blocks is
+    a switch away from a ChatGPT plan whose session logs are still unexpired,
+    and ``--no-budget-gate`` covers that.
+    """
+    if home is None:
+        home = codex_home()
+
+    # Checked before auth.json: Codex authenticates with this key regardless of
+    # what the last login stored.
+    if os.environ.get("CODEX_API_KEY", "").strip():
+        return AUTH_MODE_APIKEY
+
+    try:
+        auth = json.loads((home / "auth.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        # ValueError covers both JSONDecodeError and the UnicodeDecodeError a
+        # non-UTF-8 auth.json raises: an unreadable file means "mode unknown",
+        # not a crashed review loop.
+        auth = None
+
+    if isinstance(auth, dict):
+        mode = auth.get("auth_mode")
+        if isinstance(mode, str) and mode.strip():
+            # Unrecognised spellings pass through as-is: they are not the
+            # API-key mode the gate bypasses, so the gate stays active.
+            spelling = mode.strip().lower()
+            return _AUTH_MODE_ALIASES.get(spelling, spelling)
+        # Older Codex versions omit auth_mode; infer from the stored payload.
+        if auth.get("tokens"):
+            return AUTH_MODE_CHATGPT
+        if auth.get("OPENAI_API_KEY"):
+            return AUTH_MODE_APIKEY
+
+    # auth.json can be missing entirely when Codex keeps credentials in the OS
+    # keyring (``cli_auth_credentials_store``); config.toml may still declare
+    # the login method, so consult it before giving up.  An ambient
+    # OPENAI_API_KEY is deliberately not consulted: Codex does not authenticate
+    # with it, so a key left in the environment for other tools must not switch
+    # the gate off.
+    config_mode = _config_auth_mode(home)
+    if config_mode is not None:
+        return config_mode
+
+    return AUTH_MODE_UNKNOWN
+
+
+def find_latest_token_count(
+    sessions_dir: Path | None = None,
+) -> dict[str, object] | None:
+    """Scan Codex session logs from last 7 days for the latest token_count event.
+
+    Returns the event dict, or ``None`` if no data found.
+    """
+    if sessions_dir is None:
+        sessions_dir = codex_home() / "sessions"
+
+    if not sessions_dir.is_dir():
+        return None
+
+    best_event: dict[str, object] | None = None
+    best_ts: object = None
+
+    now = datetime.now(tz=UTC)
+    for offset in range(7):
+        day = now - timedelta(days=offset)
+        day_dir = sessions_dir / day.strftime("%Y/%m/%d")
+        if not day_dir.is_dir():
+            continue
+
+        for jsonl_file in day_dir.glob("*.jsonl"):
+            try:
+                for line in jsonl_file.read_text(encoding="utf-8").splitlines():
+                    if not line.strip():
+                        continue
+                    try:
+                        entry = json.loads(line)
+                    except json.JSONDecodeError:
+                        continue
+
+                    if (
+                        entry.get("type") == "event_msg"
+                        and isinstance(entry.get("payload"), dict)
+                        and entry["payload"].get("type") == "token_count"
+                    ):
+                        ts = entry.get("timestamp")
+                        if best_ts is None or (ts is not None and ts > best_ts):
+                            best_ts = ts
+                            best_event = entry
+            except OSError:
+                continue
+
+    return best_event
+
+
+def check_token_budget(
+    sessions_dir: Path | None = None,
+    home: Path | None = None,
+) -> BudgetStatus:
+    """Get Codex budget status from session logs.
+
+    API-key auth is billed per token and carries no plan rate-limit windows,
+    so no budget data is reported for it — session logs written under a
+    previous ChatGPT login would otherwise gate the loop indefinitely.
+    """
+    if home is None:
+        # Session logs live at <codex_home>/sessions; callers that override
+        # only sessions_dir (tests, custom layouts) get the matching home.
+        home = sessions_dir.parent if sessions_dir is not None else codex_home()
+
+    auth_mode = detect_auth_mode(home)
+    if auth_mode == AUTH_MODE_APIKEY:
+        logger.info(
+            "Codex is on API-key auth — no plan rate limits to check.",
+        )
+        return BudgetStatus(
+            five_hour_used_pct=None,
+            seven_day_used_pct=None,
+            tokens_used=0,
+            mode=AUTH_MODE_APIKEY,
+            tier="",
+            resets_at=None,
+            seven_day_resets_at=None,
+        )
+
+    event = find_latest_token_count(sessions_dir)
+
+    if event is None:
+        return BudgetStatus(
+            five_hour_used_pct=None,
+            seven_day_used_pct=None,
+            tokens_used=0,
+            mode="no_data",
+            tier="",
+            resets_at=None,
+            seven_day_resets_at=None,
+        )
+
+    now_epoch = int(datetime.now(tz=UTC).timestamp())
+    payload = event.get("payload", {})
+    rate_limits = payload.get("rate_limits", {}) if isinstance(payload, dict) else {}
+
+    primary = rate_limits.get("primary") if isinstance(rate_limits, dict) else None
+    secondary = rate_limits.get("secondary") if isinstance(rate_limits, dict) else None
+
+    windows = _map_windows(
+        (
+            (primary, FIVE_HOUR_WINDOW),
+            (secondary, SEVEN_DAY_WINDOW),
+        ),
+        now_epoch,
+    )
+    five_pct, five_resets = windows.get(FIVE_HOUR_WINDOW, (None, None))
+    seven_pct, seven_resets = windows.get(SEVEN_DAY_WINDOW, (None, None))
+
+    return BudgetStatus(
+        five_hour_used_pct=five_pct,
+        seven_day_used_pct=seven_pct,
+        tokens_used=0,
+        mode="session_log",
+        tier="",
+        resets_at=five_resets,
+        seven_day_resets_at=seven_resets,
+    )
+
+
+def _map_windows(
+    slots: tuple[tuple[object, str], ...],
+    now_epoch: int,
+) -> dict[str, tuple[int | None, str | None]]:
+    """Assign Codex rate-limit windows to their BudgetStatus fields.
+
+    Each ``(window, positional_kind)`` pair is classified by the window's own
+    ``window_minutes``; the positional kind is only a fallback for payloads
+    that omit it.  When two windows land on the same kind, the higher usage
+    wins so the gate stays conservative.
+    """
+    mapped: dict[str, tuple[int | None, str | None]] = {}
+
+    for window, positional_kind in slots:
+        if not isinstance(window, dict) or not window:
+            continue
+
+        kind = codex_window_kind(window) or positional_kind
+        pct, resets = codex_parse_window(window, now_epoch)
+
+        previous = mapped.get(kind)
+        if previous is not None:
+            prev_pct = previous[0]
+            if pct is None or (prev_pct is not None and prev_pct >= pct):
+                continue
+
+        mapped[kind] = (pct, resets)
+
+    return mapped
+
+
+def codex_budget_sufficient(
+    scope: BudgetScope,
+    status: BudgetStatus | None = None,
+    sessions_dir: Path | None = None,
+) -> bool:
+    """Go/no-go for Codex at the given scope."""
+    if status is None:
+        status = check_token_budget(sessions_dir)
+    if status.mode == AUTH_MODE_APIKEY:
+        return True
+    return budget_sufficient(scope, status)

{overkill-0.7.0 → overkill-0.8.2}/src/mr_overkill/budget_report.py

@@ -6,8 +6,14 @@ import json
 import sys
 from dataclasses import asdict
 
-from mr_overkill.budget import budget_sufficient, has_threshold
+from mr_overkill.budget import (
+    SKIP_BUDGET_ENV_VAR,
+    budget_gate_disabled,
+    budget_sufficient,
+    has_threshold,
+)
 from mr_overkill.budget.claude import check_token_budget as claude_check
+from mr_overkill.budget.codex import AUTH_MODE_APIKEY
 from mr_overkill.budget.codex import check_token_budget as codex_check
 from mr_overkill.models import BudgetScope, BudgetStatus
 
@@ -47,6 +53,10 @@ def _print_codex(status: BudgetStatus) -> None:
     print("Codex Token Budget")
     print(_HEADER)
     print(f"  Mode:     {status.mode}")
+    if status.mode == AUTH_MODE_APIKEY:
+        print("  No plan rate limits (API-key billing).")
+        print()
+        return
     print(
         f"  5h used:  {_fmt_pct(status.five_hour_used_pct)}"
         f"{_fmt_reset(status.resets_at)}"
@@ -73,13 +83,23 @@ def _print_scope_table(claude_st: BudgetStatus, codex_st: BudgetStatus) -> None:
         BudgetScope.MICRO, BudgetScope.MODULE,
         BudgetScope.LAYER, BudgetScope.FULL,
     )
+    gate_off = budget_gate_disabled()
     for scope in scopes:
-        if has_threshold(scope):
-            c_label = "GO" if budget_sufficient(scope, claude_st) else "NOGO"
-            x_label = "GO" if budget_sufficient(scope, codex_st) else "NOGO"
-        else:
+        if not has_threshold(scope):
             c_label = x_label = "—"
+        else:
+            c_label = "GO" if gate_off or budget_sufficient(
+                scope, claude_st
+            ) else "NOGO"
+            codex_go = (
+                gate_off
+                or codex_st.mode == AUTH_MODE_APIKEY
+                or budget_sufficient(scope, codex_st)
+            )
+            x_label = "GO" if codex_go else "NOGO"
         print(f"  {scope.value:<8} {c_label:<7} {x_label:<7} —")
+    if gate_off:
+        print(f"  (all GO: {SKIP_BUDGET_ENV_VAR} is set)")
 
 
 def print_budget_report(*, json_mode: bool = False) -> int: