feat(codex): one card per account across Codex homes and pi logins (read-only)

[robinebers]

Approved issue

Fixes #1265 — part 2 of 3 split out of #1319 (after #1320). Part 3 (#1322) adds token refresh for independent homes.

TL;DR

Every ChatGPT account signed in to a Codex home (CODEX_HOME, ~/.codex, ~/.config/codex, sibling ~/.codex-* / ~/.config/codex-*), to pi (openai-codex, openai-codex-N), to xswap, or to the Keychain becomes its own Codex card, matched by workspace + email. Every discovered credential is read-only in this PR.

What was happening

• Only xswap slots produced account cards. Two Codex homes, or a Codex home plus a pi login, were one codex card: the meters came from whichever login won, while local spend from both accounts was summed onto it (Support multiple Codex accounts across Codex homes and pi logins #1265).
• Nothing knew about pi's openai-codex-N multi-pass entries at all, so a pi-only account had no card.

What this changes

• CodexHomeScanner (new): enumerates candidate homes and reads which account is signed in at each (CodexHomeLogin); a token-bearing home whose claims name no account sets hasIncompleteLogin instead of vanishing. Also owns configuredHomeValues/standardizedHome, which CodexAuthStore.authPaths and DefaultAccountObserver.observeCodex now reuse instead of their own copies.
• PiCodexLoginScanner (new): reads pi's auth.json OAuth entries and multi-pass.json labels into PiCodexLoginScan { logins, hasIncompleteLogin }. loadAuth re-reads the live token on every use.
• ProviderAccountAssembly.makeCodexCards merges homes + pi + Swap + a usable default Keychain login by CodexAccountIdentity and returns a CodexAccountDiscovery:

  struct CodexAccountDiscovery {
      var cards: [CodexAccountCard]
      var plainAuthHomes: [String]                       // single-account path only
      var plainPiCredentialSources: [CodexPiCredentialSource]
      var allowsUnattributedHistory: Bool
  }
  guard !swaps.isEmpty || hasEstablishedAccounts || knownIdentities.count > 1 else {
      return CodexAccountDiscovery(plainAuthHomes: …, plainPiCredentialSources: …,
                                   allowsUnattributedHistory: knownIdentities.isEmpty || !hasUnidentifiedLogin)
  }

  A single account (even across several homes and pi) stays on the plain codex provider, which now receives the discovered sibling homes and pi entries as read-only credential sources and scans those homes' rollouts for its spend tiles. A login too incomplete to name an account still turns off unattributed spend on that plain card. In card mode the one attribution rule is allowsUnattributedHistory = !hasIncompleteLogin && codexRecords == 1.
• Card labels: a name the user chose (xswap alias, then pi multi-pass label) wins over the generic workspace label, and the first user-chosen name is kept — a later pi label never renames an aliased xswap slot, but does name an alias-less one.
• CodexAuthStore gains piCredentialSources and a .pi Source; save(.pi) throws. Scoped stores already strip refresh tokens for every candidate, so all card credentials — homes, Swap, pi, Keychain — stay read-only; the account refresh loop is unchanged from main (tries each matching login, no token rotation).
• CodexAccountIdentity(auth:) falls back to the access token's claims (pi entries have no id_token) and reads the email from the https://api.openai.com/profile claim.
• CodexAccountCard gains piCredentialSources; ProviderCatalog.make(defaults:codex:) takes the whole discovery. Registry source kinds codexHome and pi added.

Heads-up

• Read-only by design here: a card whose token has expired shows Re-login until Codex/pi renews it. feat(codex): refresh and persist tokens for independent Codex homes on account cards #1322 lets independent homes rotate their own tokens (with symlink-safe protection for Swap-managed homes).
• Card mode is sticky via the registry (identityKey.contains("|")), same as the existing Swap behavior.
• Not changed (flagged by Devin Review, left for a maintainer call): the plain card still imports a synced peer's legacy codex history wholesale, as on main, even when local unattributed history is off.

Tests

New suites replace #1319's two files (and their duplicated JWT helpers), organized by subsystem:

• CodexMultiAccountFixtures — shared token/codexAuth/piAuth builders and a scratch-defaults helper.
• CodexHomeDiscoveryTests — home enumeration (incl. a real hidden-dir scan), identity fallback, pi scan/incomplete flag/provider-id shape, observer behavior, read-only scoped candidates, pi reload + fallback through CodexProvider.refresh.
• CodexMultiAccountAssemblyTests — single-account stays legacy, incomplete/account-only/email-only logins, incomplete pi login beside one plain account disables unattributed spend, xswap alias survives a matching pi login, home+pi merge, same-workspace users, registry order across a default switch, catalog wiring, Swap homes stay read-only through refresh.
• CodexDiscoveryGateTests — the single-vs-many gate: a lone pi login or sibling home feeds the plain card (credentials load, stay read-only, rollouts scanned), home + distinct Keychain and pi + distinct Keychain each yield two cards, an identity-less token home disables unattributed history, an alias-less xswap slot takes a pi label.

swift build, swift test (1471 tests, 0 failures), ./script/build_and_run.sh verify.

Screenshots

Not applicable.

Link to Devin session: https://app.devin.ai/sessions/a6161a7f3fd44b62b23c5de7ca15d4ab
Open in Devin Desktop: https://app.devin.ai/desktop/session/a6161a7f3fd44b62b23c5de7ca15d4ab?variant=devin
Requested by: @robinebers

---

Note

Medium Risk
Changes auth discovery, multi-account card assembly, and read-only credential handling for Codex usage and spend attribution; mistakes could show wrong limits or merge/split accounts incorrectly.

Overview
OpenUsage now discovers Codex logins in default and sibling homes (~/.codex-*, ~/.config/codex-*), pi (openai-codex, openai-codex-N), xswap, and the keychain, then builds one Codex card per ChatGPT workspace + email. The same account across several homes or pi still maps to a single card; a lone account keeps the plain codex provider until a second identity (or existing multi-account registry / swap) appears.

New scanners (CodexHomeScanner, PiCodexLoginScanner) drive makeCodexCards, which wires each card with scoped authHomes, piCredentialSources, and stricter unattributed local spend (off when multiple accounts exist or any login cannot name workspace and email).

Credentials on cards are read-only: scoped stores strip refresh tokens; pi uses a new .pi auth source and save rejects it. Usage refresh re-reads live tokens and tries matching logins (including pi fallback) without rotating tokens owned by Codex, xswap, or pi. Identity parsing now falls back to access-token JWT claims so pi-only OAuth works.

Docs and tests cover discovery, assembly, read-only refresh, and catalog wiring.

^{Reviewed by Cursor Bugbot for commit 44855b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[pullfrog]

Important

Discovery is bypassed for some supported login combinations, and incomplete-login evidence can still be lost before spending attribution is decided. Three fixes are detailed inline.

Reviewed changes across home/pi discovery, account assembly, credential loading, persistence, tests, and documentation.

• Login discovery: Adds configured/default/sibling Codex homes and numeric pi OAuth slots, with access-token identity fallback.
• Account cards: Merges credentials by workspace and email, persists card identities, and wires live pi sources into read-only scoped stores.
• Spending policy: Disables unattributed history for multi-account cards and some incomplete logins.
• Verification: Inspected the new tests and traced runtime consumers. The macOS SwiftPM suite could not run in this Linux environment; GitHub's Build and Test check was pending.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Astra ｜ 𝕏}

[pullfrog]

[P2] Carry incomplete-login evidence through discovery and the legacy path. A token-bearing home with neither workspace nor email is already filtered out of homeLogins, while a detected incomplete pi login is ignored when the single-account gate returns early; both cases can leave another account's unattributed spending enabled.

Technical details

## Affected sites
- CodexHomeScanner.swift:87-92 drops token logins when CodexAccountIdentity cannot be constructed, leaving no incompleteness flag.
- ProviderAccountAssembly+Codex.swift:41 returns before consuming piScan.hasIncompleteLogin.
- ProviderCatalog.swift:45-46 creates the plain provider with allowsUnattributedHistory defaulting to true; CodexProvider.snapshot then includes pi/OpenCode history and the default native scanner permits unattributed history.

## Required outcome
- Preserve unresolved token-login footprints independently of card identities and apply the resulting attribution policy even when the UI keeps a plain Codex card.
- Add coverage for one complete home login plus an identity-incomplete pi login without Swap, and one established complete card plus a token-bearing home whose identity is entirely missing.
- Assert the resulting runtime disables unattributed local history. The existing incomplete-pi test only covers the Swap-forced card path.

[pullfrog]

The reported complete-account-plus-incomplete-login cases are fixed, but the thread remains open because knownIdentities.isEmpty still enables unattributed history when all discovered token logins are unidentified.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using GPT Astra ｜ 𝕏}

[devin-ai-integration]

Leaving knownIdentities.isEmpty as is, deliberately. When no login names an account there is exactly one credential OpenUsage knows about (the one the plain card is about to use), so there is no second card the unowned history could be mis-assigned to — disabling history there would blank the spend tiles for every install whose token simply lacks identity claims, with nothing gained. The case the flag protects against (an unidentified token beside a known account) is covered by !hasUnidentifiedLogin. Two identity-less homes at once is theoretically ambiguous, but the scanners can't distinguish one unnamed account from two either way; happy to tighten if the maintainer prefers blanking history over showing it in that case.

[devin-ai-integration]

👀 1 finding needs your review

Devin fixed 3 of 4 findings on 96994f0. Click a finding below to jump to its comment.

For your review (1)

• Unattributed peer spending survives exclusion

Fixed by Devin (3)

• Pi-only account cannot show live limits
• Distinct Keychain account disappears behind home
• Incomplete home login retains unattributed spending

View all findings in Devin Review

[pullfrog]

Important

A lone sibling-home account can now load live usage, but its native session spending is still omitted. One new finding is detailed inline; the partially addressed attribution thread remains open.

Reviewed changes since 96994f06, focusing on single-account routing and the discovery gate.

• Preserved discovered credentials: Passed lone home/pi sources through CodexAccountDiscovery into the plain provider while keeping them read-only.
• Counted Keychain accounts: Included the default Keychain identity before choosing plain-card versus account-card mode.
• Retained incomplete-login evidence: Added a home-scan flag for identity-less tokens and propagated it into history policy.
• Corrected label precedence: Allowed explicit pi labels to name Swap slots without aliases.
• Added regression coverage: Added credential-use, read-only, Keychain-gate, history-policy, and label tests, and updated documentation.

Tests were inspected but not run locally because the package requires macOS frameworks and this environment is Linux. GitHub's Build and Test check was in progress when checked.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Astra ｜ 𝕏}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔴 Unattributed peer spending survives exclusion

When an incomplete pi login disables local history, codexAllowsUnattributedHistory leaves the card bare. UsageHistoryAggregator.merged still imports its unowned peer history, so spend tiles can show another account's spending.

Learn more

The plain provider's allowsUnattributedHistory gates local scanning and cache stripping. However, UsageHistoryAggregator.merged handles a bare codex card whose identity lacks | using document.providers[providerID], without consulting this gate. When peers are loaded, rebuildRenderedSnapshots puts their history back on the visible snapshot.

Example: A single known Codex login and an incomplete pi login disable local history. A synced peer document with legacy codex spending still adds that spending to the card after launch.

Recommended fix: Pass Codex's unattributed-history policy into peer history merging and exclude unowned peer contributions when the plain provider disallows them.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Confirmed, but leaving it for a maintainer call rather than growing this PR. The behavior is inherited from main: the plain codex card has always imported a synced peer's providers["codex"] history wholesale (UsageHistoryAggregator.merged only account-filters Claude cards and |-keyed Codex cards). This PR's allowsUnattributedHistory gates the local scanners; it doesn't reach the peer merge, so a second Mac's legacy codex history still lands on the plain card when an incomplete pi login has turned local history off.

Fixing it means threading the Codex policy into UsageHistoryAggregator.merged (alongside the existing localClaudeCards argument) and skipping peer import for the plain card when it's false — the plain card carries no identity, so nothing from a peer can be proven to be its own. Small change, but it touches the sync/aggregation layer that #1265 didn't ask about; I'd do it as a follow-up unless you want it here.

[pullfrog]

Important

No new issues found in this delta. The earlier incomplete-login attribution finding remains open, so approval is still withheld.

Reviewed changes since afc4bde1, focused on native spending for a lone sibling-home account.

• Connected discovered log roots: Passed plainAuthHomes to the plain card's native log scanner without changing its attribution policy.
• Added regression coverage: Verified through the catalog that the discovered sibling home reaches the scanner; this assertion would fail before the fix.
• Updated documentation: Clarified that the plain card includes the discovered home's session logs in spending.

Inspected the new wiring test and existing additional-home rollout tests. Tests were not run locally because this Linux environment cannot run the macOS package; GitHub's Build and Test check was still in progress when checked.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using GPT Astra ｜ 𝕏}