fix(voice): validate Codex OAuth and report unknown usage

src/codexOauthRealtime.test.mjs

@@ -4,11 +4,32 @@ import test from 'node:test';
 import path from 'node:path';
 import {
   codexAuthPath,
+  preferCodexOAuth,
   readCodexOAuthAccessToken,
   resolveCodexExecutable,
   startCodexChatGptLogin,
 } from '../server/providers/openai/codex-auth.js';
 
+const nowMs = Date.UTC(2026, 8, 27);
+const jwt = (payload) =>
+  `${Buffer.from('{}').toString('base64url')}.${Buffer.from(JSON.stringify(payload)).toString('base64url')}.signature`;
+const auth = (token, extras = {}) =>
+  JSON.stringify({
+    auth_mode: 'chatgpt',
+    tokens: { access_token: token, refresh_token: 'refresh-fixture' },
+    ...extras,
+  });
+
+test('optional Codex OAuth pin fails closed on ambiguous values', () => {
+  assert.equal(preferCodexOAuth({}), false);
+  assert.equal(preferCodexOAuth({ GEV_PREFER_CODEX_OAUTH: 'true' }), true);
+  assert.equal(preferCodexOAuth({ GEV_PREFER_CODEX_OAUTH: 'off' }), false);
+  assert.throws(
+    () => preferCodexOAuth({ GEV_PREFER_CODEX_OAUTH: 'maybe' }),
+    /must be true or false/,
+  );
+});
+
 test('Codex auth path follows explicit auth file, CODEX_HOME, then home directory', () => {
   assert.equal(
     codexAuthPath({
@@ -30,28 +51,85 @@ test('Codex auth path follows explicit auth file, CODEX_HOME, then home director
   );
 });
 
-test('Codex OAuth token reader returns only the access token and fails closed', () => {
+test('Codex OAuth reader accepts a current ChatGPT token and rejects unusable credentials', () => {
+  const current = jwt({ exp: nowMs / 1000 + 3600 });
   assert.equal(
     readCodexOAuthAccessToken({
       authPath: '/unused',
-      readFile: () => JSON.stringify({ tokens: { access_token: ' oauth-fixture ' } }),
+      nowMs,
+      readFile: () => auth(current),
     }),
-    'oauth-fixture',
+    current,
   );
   for (const readFile of [
     () => '{bad json',
     () => JSON.stringify({ tokens: {} }),
+    () => auth(current, { auth_mode: 'apikey' }),
+    () =>
+      JSON.stringify({
+        OPENAI_API_KEY: 'sk-fixture',
+        tokens: { access_token: current, refresh_token: 'refresh-fixture' },
+      }),
+    () =>
+      JSON.stringify({
+        auth_mode: 'chatgpt',
+        tokens: { access_token: current },
+      }),
+    () => auth('opaque-token'),
+    () => auth('header.not-json.signature'),
+    () => auth(jwt({ exp: 'tomorrow' })),
     () => {
       throw new Error('missing');
     },
   ]) {
     assert.throws(
-      () => readCodexOAuthAccessToken({ authPath: '/unused', readFile }),
+      () => readCodexOAuthAccessToken({ authPath: '/unused', readFile, nowMs }),
       /ChatGPT sign-in is unavailable/,
     );
   }
 });
 
+test('Codex OAuth reader enforces expiry margin and bounds tokens without exp by file age', () => {
+  for (const exp of [nowMs / 1000 - 1, nowMs / 1000 + 59]) {
+    assert.throws(
+      () =>
+        readCodexOAuthAccessToken({
+          authPath: '/unused',
+          nowMs,
+          readFile: () => auth(jwt({ exp })),
+        }),
+      /sign-in has expired/,
+    );
+  }
+  const noExp = jwt({ sub: 'fixture' });
+  const base = { authPath: '/unused', nowMs, readFile: () => auth(noExp) };
+  assert.equal(
+    readCodexOAuthAccessToken({
+      ...base,
+      statFile: () => ({ mtimeMs: nowMs }),
+    }),
+    noExp,
+  );
+  assert.throws(
+    () =>
+      readCodexOAuthAccessToken({
+        ...base,
+        statFile: () => ({ mtimeMs: nowMs - 3600_000 }),
+      }),
+    /sign-in has expired/,
+  );
+  assert.throws(
+    () =>
+      readCodexOAuthAccessToken({
+        ...base,
+        statFile: () => {
+          throw new Error('missing');
+        },
+      }),
+    /sign-in is unavailable/,
+  );
+});
+
 test('Codex login resolves an installed executable before PATH and starts browser auth detached', async () => {
   const checked = [];
   assert.equal(

src/tooling/localServices.test.mjs

@@ -217,15 +217,44 @@ test('Realtime handler keeps API key as default and uses OAuth only when request
   );
   const token = routes.get('/api/realtime/token');
 
-  assert.equal((await request(token)).status, 200);
+  const apiResponse = await request(token);
+  assert.equal(apiResponse.status, 200);
+  assert.equal(apiResponse.headers['x-gev-voice-auth'], 'env');
   assert.equal(oauthReads, 0, 'default cloud voice does not read OAuth');
   assert.equal(authorizations.at(-1), 'Bearer fixture-api-key');
 
-  assert.equal((await request(token, { url: '/?auth=oauth' })).status, 200);
+  const oauthResponse = await request(token, { url: '/?auth=oauth' });
+  assert.equal(oauthResponse.status, 200);
+  assert.equal(oauthResponse.headers['x-gev-voice-auth'], 'codex-oauth');
   assert.equal(oauthReads, 1);
   assert.equal(authorizations.at(-1), 'Bearer fixture-oauth-token');
 });
 
+test('a Codex OAuth pin refuses API-key minting without silently switching modes', async (t) => {
+  env(t, 'GEV_RATELIMIT_OPENAI_PER_MIN', undefined);
+  const authorizations = [];
+  const routes = install(
+    openAiRealtimeProxy({
+      realtime: {
+        environment: { GEV_PREFER_CODEX_OAUTH: 'true' },
+        resolveApiKey: () => assert.fail('pinned OAuth cannot read an API key'),
+        resolveOAuthAccessToken: () => 'fixture-oauth-token',
+        fetchImpl: async (_url, options) => {
+          authorizations.push(options.headers.Authorization);
+          return Response.json({ value: 'fixture-ephemeral' });
+        },
+      },
+    }),
+  );
+  const token = routes.get('/api/realtime/token');
+  const refused = await request(token);
+  assert.equal(refused.status, 503);
+  assert.equal(refused.json().code, 'CODEX_OAUTH_REQUIRED');
+  assert.equal(authorizations.length, 0);
+  assert.equal((await request(token, { url: '/?auth=oauth' })).status, 200);
+  assert.deepEqual(authorizations, ['Bearer fixture-oauth-token']);
+});
+
 test('OAuth status and token minting never expose local OAuth to remote clients', async () => {
   let oauthReads = 0;
   const routes = install(

src/voice/gevRealtime.test.mjs

@@ -3194,18 +3194,29 @@ test('F1: the toggle still records the next-session preference while live', () =
   assert.match(ui.tierButton.title, /this session stays on/i);
 });
 
-test('OAuth cloud sessions hide API spend and do not trip the API spend guard', () => {
+test('OAuth cloud sessions report unknown cost and usage without tripping the API spend guard', () => {
   const { controller, ui } = costControllerHarness();
   controller.status = 'listening';
   controller._cost.cloudVoiceAuth = 'oauth';
   controller._cost.sessionCloudVoiceAuth = 'oauth';
   controller.syncCostUi();
   const before = controller.costTracker.state();
-  assert.equal(ui.costValue.hidden, true);
-  assert.equal(controller.recordUsage(usdUsage(100)), null);
+  assert.equal(ui.costValue.hidden, false);
+  assert.equal(ui.costValue.textContent, 'COST UNKNOWN');
+  assert.deepEqual(controller.recordUsage(usdUsage(100)), {
+    responses: 1,
+    input: 0,
+    output: 1562500,
+    costKnown: false,
+  });
   const after = controller.costTracker.state();
   assert.equal(after.totalUsd, before.totalUsd);
   assert.equal(controller.costCapStopped, false);
+  assert.match(ui.costValue.title, /1 response\(s\).*1562500 output tokens/);
+  controller.dc = {};
+  controller.responseActive = true;
+  controller.stop();
+  assert.match(ui.costValue.title, /Usage is incomplete/);
 });
 
 test('F1: when idle, toggling does re-price the preview meter', () => {

src/voice/realtimeController.js

@@ -239,7 +239,10 @@ export class GevRealtimeController extends RealtimeFacade {
       status: this.status,
       connection: this.connectionDiagnostics(),
     });
-    if (this.dc && this.responseActive) this.costTracker.markIncomplete();
+    if (this.dc && this.responseActive) {
+      this.costTracker.markIncomplete();
+      this.syncCostUi();
+    }
     this._connection.closeTransport();
     this.stopVoiceVisualizer();
     this._connection.releaseMedia();

src/voice/realtimeCost.js

@@ -19,6 +19,7 @@ export class RealtimeCost {
     this.voiceLimits = readStoredVoiceLimits();
     this.cloudVoiceAuth = readStoredCloudVoiceAuthMode();
     this.sessionCloudVoiceAuth = null;
+    this.oauthUsage = { responses: 0, input: 0, output: 0 };
     this.costTracker = createVoiceCostTracker({
       tier: this.voiceTier,
       limits: this.voiceLimits,
@@ -60,7 +61,20 @@ export class RealtimeCost {
     }
     if (this.ui?.costValue) {
       const liveAuth = this.sessionCloudVoiceAuth || this.cloudVoiceAuth;
-      this.ui.costValue.hidden = liveAuth === 'oauth';
+      if (liveAuth === 'oauth') {
+        const { responses, input, output } = this.oauthUsage;
+        this.ui.costValue.hidden = false;
+        this.ui.costValue.textContent = 'COST UNKNOWN';
+        this.ui.costValue.dataset.level = 'unknown';
+        this.ui.costValue.title =
+          `ChatGPT OAuth session: ${responses} response(s), ${input} input and ${output} output tokens reported. ` +
+          'USD cost and the API spend cap are unavailable for this auth mode.' +
+          (state.incomplete
+            ? ' Usage is incomplete because a response was still in flight when the session ended.'
+            : '');
+        return;
+      }
+      this.ui.costValue.hidden = false;
       this.ui.costValue.textContent = state.display;
       this.ui.costValue.dataset.level = state.level;
       this.ui.costValue.title =
@@ -141,7 +155,15 @@ export class RealtimeCost {
    */
   recordUsage(usage) {
     if (!usage) return null;
-    if (this.sessionCloudVoiceAuth === 'oauth') return null;
+    if (this.sessionCloudVoiceAuth === 'oauth') {
+      const count = (value) =>
+        Number.isFinite(value) && value > 0 ? value : 0;
+      this.oauthUsage.responses += 1;
+      this.oauthUsage.input += count(usage.input_tokens);
+      this.oauthUsage.output += count(usage.output_tokens);
+      this.syncCostUi();
+      return { ...this.oauthUsage, costKnown: false };
+    }
     const state = this.costTracker.record(usage);
     this.syncCostUi();
     if (state.warnCrossed) {
@@ -198,6 +220,7 @@ export class RealtimeCost {
     this.voiceLimits = readStoredVoiceLimits();
     this.cloudVoiceAuth = readStoredCloudVoiceAuthMode();
     this.sessionCloudVoiceAuth = this.cloudVoiceAuth;
+    this.oauthUsage = { responses: 0, input: 0, output: 0 };
     this.costCapStopped = false;
     // Provisional meter (tier-priced) so the readout shows $0.00 while
     // connecting. It is REPLACED below with one bound to the model the server