fix(codex): attribute OpenCode 2 ChatGPT OAuth usage

[validatedev]

TL;DR

Codex Today stayed empty after upgrading to OpenCode 2 because usage moved to session_message and OAuth moved to the credential table. This reads both, picks the live OpenAI credential across channel databases, and simplifies the OpenCode scanning code.

What was happening

• OpenCode 2 writes sessions to session_message and OAuth to the SQLite credential table; the v1 message table and auth.json stopped receiving new rows, so the Codex card showed nothing.
• A leftover opencode-next.db sorted before opencode.db and could win the OAuth check.
• A stale imported auth.json could revive when a credential query failed.
• active/time_updated were converted with Int(Double), which traps on out-of-range values.

What this changes

• Reads session_message (v2) alongside message (v1); the OAuth-creation cutoff bounds only v2 rows so pre-upgrade history still counts.
• Ranks current credential rows globally across databases and does not fall back to auth.json on a hard SQLite failure.
• Keeps credential ranking fields as Double.
• Refactor: OAuth bound lives in the v2 SQL branch (no source column or Swift post-filter), schema probe moved into the scanner, OpenCodePaths is paths-only, tests share one store factory and match exact SQL. Net -141 lines.
• Docs: docs/providers/codex.md, docs/providers/opencode.md.

Heads-up

• A transient SQLite lock disables the auth.json fallback for that refresh (self-corrects next refresh); deliberate so stale auth.json cannot revive.
• Credential-lookup failures warn on every refresh rather than once; the auth store is a sync struct so wiring UsageLogReadFailureReporter is a follow-up.
• Out of scope: OpenCodeUsageScanner (the OpenCode card) still reads only message, so v2 installs miss session_message rows there.

Tests

swift build --build-tests; OpenCode/Codex suites: 201 tests, 0 failures. Generated SQL verified against a real sqlite3 database.

[robinebers]

@pullfrog review this

[pullfrog]

Important

Two credential-attribution cases need fixing: an empty OpenCode 2 credential table revives stale file-based OAuth, and one channel's credential controls every channel's usage.

Reviewed changes Reviewed the OpenCode 2 Codex-attribution implementation, related tests, and provider documentation.

• Credential lookup: Database-first OpenAI credential discovery, cross-channel ranking, and failure handling.
• Usage scanning: Schema detection, v1/v2 message queries, completion filters, and the v2 OAuth creation-time boundary.
• Regression coverage and docs: Updated test doubles, credential/scanner assertions, and documented attribution behavior.

Validated both findings with an isolated Swift harness compiling the production OpenCodeAuthStore.swift against real in-memory SQLite fixtures, and checked the upstream credential lifecycle. The full macOS test suite was not run on this Linux runner.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Astra ｜ 𝕏}

[validatedev]

Both review findings addressed in the latest commit:

• Empty credential table — openAICredential(databasePath:) now distinguishes a successful empty result (OpenCode 2 logout → not OAuth, no auth.json fallback) from a missing table (OpenCode 1 → auth.json still authoritative) and a hard failure (throws; the scanner records it as a per-database read failure). Regression: testEmptyCredentialTableDoesNotFallBackToStaleAuthFile, testLoggedOutV2DatabaseIsSkippedWhileAuthFileStillHoldsOAuth.
• Per-channel credentials — the scanner evaluates each database with its own credential and login time; the global cross-database ranking is gone. Regressions assert totals and per-database SQL bounds: testEachChannelDatabaseIsGatedByItsOwnCredential, testEachOAuthChannelUsesItsOwnLoginTimeAsTheV2Bound, testEachChannelDatabaseIsJudgedByItsOwnCredential.

Docs updated (docs/providers/codex.md, docs/providers/opencode.md). Credential SQL verified against real sqlite3 for the empty-table, row, and no-table cases.

[validatedev]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2dd2b63e47

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the behavioral changes in 2dd2b63 since the previous review at d6b7dff.

• Separated channel attribution: Matched each database's usage to its own current credential and OAuth creation time, removing global credential ranking.
• Restricted legacy fallback: Treated an empty OpenCode 2 credential table as logged out, preserved file fallback for missing legacy tables, and routed credential failures through the scanner's error reporting.
• Added regressions and documentation: Covered mixed channel credentials, separate login cutoffs, and stale-file logout behavior, and documented channel-specific attribution.

Validated the production auth store and scanner with an isolated Swift 6 harness executing real SQLite fixtures, including exact token totals for separate channel cutoffs and successful sibling scans after a database failure. The full macOS suite was not run locally on this Linux runner; GitHub's Build and Test check passed.

  ^{｜ View workflow run ｜ Using GPT Astra ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the timestamp-validation fix in 8dbbd2c since the previous review at 2dd2b63.

• Bounded credential timestamps: Rejected invalid or out-of-range creation times before the scanner converts them to integer milliseconds.
• Surfaced malformed credentials: Changed malformed database rows into read failures without reviving the legacy file fallback.
• Added regression coverage: Asserted the expected error for negative and overflowing timestamp values.

Validated the production auth store and numeric parser with an isolated Swift 6 harness covering invalid timestamps, exact integer conversions at valid boundaries, null timestamps, and malformed rows. All checks passed. The full macOS suite could not run on this Linux runner; GitHub's Build and Test check was still running when inspected.

  ^{｜ View workflow run ｜ Using GPT Astra ｜ 𝕏}

[pullfrog]

Run failed. View the logs →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using GPT Astra ｜ 𝕏}

[robinebers]

@pullfrog review

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed all nine changed files covering OpenCode 2 usage attribution to Codex, regression tests, and provider documentation.

• Credential attribution: Reads each channel database’s current OpenAI credential, limits auth.json fallback to legacy databases, and rejects implausible timestamps.
• Usage scanning: Supports both message schemas, counts completed assistants and compactions, and applies each channel’s OAuth creation cutoff only to v2 rows.
• Tests and documentation: Covers channel isolation, logout, read failures, schema selection, and timestamp validation, with updated attribution guidance.

Validated the production SQL templates against real in-memory SQLite fixtures for v1-only, v2-only, and mixed databases, including completion, cost, and login-time filters and credential selection. Checked the v2 record shapes against OpenCode’s beta message schema. The full macOS suite was not run on this Linux runner; GitHub’s Build and Test check passed.

  ^{｜ View workflow run ｜ Using GPT Astra ｜ 𝕏}