Price free Codex Auto-review requests at $0 - #4453

Fixes #4452.

Summary

A codex-auto-review request is now priced at an exact $0, instead of left unpriced, when both hold:

• its timestamp is at or after 2026-10-06T07:00:00Z (midnight US Pacific on the day OpenAI made Auto-review free for ChatGPT sign-in);
• its rollout's leaf session_meta has a non-empty creator_account_id. Codex sets that field only for ChatGPT-backed auth, so API-key sessions don't have it.

Its tokens stay in day, model, session, and project totals. Auto-review stops turning the Usage & Spend Codex cost into a lower bound. An explicit custom-pricing rate for codex-auto-review still wins over $0.

 codexSessionMetadata(from:)
+  hasCreatorAccount = non-blank payload.creator_account_id, set from the leaf session_meta only
+                      -> CostUsageCodexSessionMetadata (cached per file, kept through dedupe filtering)

 buildCodexReportFromCache
+  report-time copy of each row: isIncludedInPlan =
+    hasCreatorAccount && knownCostNanos == nil && ts >= cutoff && model == codex-auto-review
+    && no custom-pricing rate for the row's priced model
+  any day/model group holding an included row -> requestPricingEvidenceGroups (no aggregate list price)

 codexRowCostBreakdown
+  included row -> tokens counted, priced request, cost exactly 0

 makeCodexBilledDayEntry
+  rows cover the group and include free requests -> no aggregate list-price fallback; group recorded in includedGroups

 addCodexHourly
+  included row in an includedGroups group -> exact 0 in hourly and quota slices
+  included row with tokens elsewhere -> unpriced, never list-priced

• Unknown stays unknown. These keep a request unpriced: no creator_account_id, a blank one, no request timestamp, a cache entry written before the flag existed, or model/day rows that don't account for the billed tokens. Auto-review before the cutoff and every other unpriced model are unchanged.
• No list price for uncovered groups. When a group's rows don't account for its billed tokens, a free request in it stays unpriced in the day, hourly, and quota-window totals. The aggregate fallback never applies a models.dev or bundled price to a group that holds a free request.
• Leaf only. Only the rollout's leaf session_meta sets the flag, matching Codex, which never updates creator_account_id on resume. A session_meta appended later can't turn an API-key session into a free one, and incremental and full parses agree.
• Cutoff per request. The cutoff compares request instants, not day keys, because day keys follow the statistics time zone.
• Pricing precedence. For eligible requests the order is custom overlay, then the Auto-review waiver ($0), then models.dev, then bundled rates. docs/model-pricing.md gives custom overlays precedence over dated pricing changes, and the waiver is one. With a codex-auto-review (or openai/codex-auto-review) overlay entry, the request is priced like any custom-priced request, including the day's aggregate estimate when its rows don't cover the day. Without one, models.dev and bundled prices never apply. A retained authoritative amount (knownCostNanos) still wins.
• Why not unmetered. Quota windows, the CLI host text, and the inline dashboard read unmeteredRequestCount > 0 as "tokens missing from totals", because missing-parent forks use it that way. Free auto-review tokens are in the totals, so a priced $0 keeps those views exact. Fork accounting is unchanged.
• Not persisted. isIncludedInPlan exists only on report-time copies. Stored rows don't change.
• Cache. Parser revision 13 reparses files in the scan window once to record the flag. The new parser hash is 6eedcbb17b6035b4. The f406dae284de4a55 store is adopted without a rebuild. Until the catch-up finishes, the previously retained report (with ≥) can still show, which only over-reports.

Known limitations

• Codex Models analytics and the Workspaces view (CodexLocalProjectUsageIndexer, CodexWorkspaceUsageSidecar) rebuild session metadata from sidecar columns that don't carry the flag. They still count auto-review as unpriced. Fixing that needs a sidecar schema change, so it's out of scope here.
• Coverage counts drop on days that become fully priced. A fully priced Codex day counts as one priced unit in coverageCounts, while a partial day counts requests (the convention from Keep priced Codex subtotals when some requests are unpriced #4279). On real history, the "priced" count drops from 9,510 to 7,065 because Oct 7 to 11 are now fully priced. Dollar and token totals don't change.

Evidence

Shipped CLI before and after, synthetic history. Three synthetic rollouts, with invented ids and token counts and no personal history:

• a ChatGPT session on Oct 8 (fake creator_account_id) with one gpt-5.4 request and two codex-auto-review requests;
• an API-key-like session on Oct 9 (no creator_account_id) with one codex-auto-review request;
• a ChatGPT session on Oct 4, before the cutoff, with one codex-auto-review request.

"Before" is the shipped CodexBarCLI 0.74.0 (/Applications/CodexBar.app/Contents/Helpers/CodexBarCLI, parser hash f406dae284de4a55). "After" is swift build --product CodexBarCLI at 636af1f1f (parser hash 6eedcbb17b6035b4). Both ran cost --provider codex --days 30 in JSON and text. The "custom" runs add {"codex-auto-review":{"input":1.25,"output":10,"cacheRead":0.125}} as custom-pricing.json in the temporary HOME.

Text output changes from Partial estimate: 4 recorded requests had no price. to Partial estimate: 2 recorded requests had no price.. The two left are the API-key and pre-cutoff requests. Oct 8 becomes fully priced, so it counts as one priced unit. With a custom rate, results match the shipped CLI.

Each run used a fresh HOME with HOME, CFFIXED_USER_HOME, CODEX_HOME, and CODEXBAR_CONFIG pointed into it, plus CODEXBAR_DISABLE_KEYCHAIN_ACCESS=1, as in Scripts/test_dashboard_private_accounts.py. sandbox-exec denied reads and writes to the live CodexBar Application Support and Caches directories, ~/.codex, and ~/.codexbar. Nothing under the live directories changed during the runs, and each CLI wrote its cost cache and models.dev catalog under the temporary HOME.

import json, sys
from pathlib import Path

SESSIONS = [
    ("2026/10/08/rollout-2026-10-08T16-00-00-00000000-0000-4000-8000-00000000000a.jsonl",
     "00000000-0000-4000-8000-00000000000a", "acct-synthetic-0001", "2026-10-08T19:00:00Z",
     [("gpt-5.4", [(100_000, 20_000, 2_000)]), ("codex-auto-review", [(50_000, 0, 500), (40_000, 0, 400)])]),
    ("2026/10/09/rollout-2026-10-09T16-00-00-00000000-0000-4000-8000-00000000000b.jsonl",
     "00000000-0000-4000-8000-00000000000b", None, "2026-10-09T19:00:00Z",
     [("codex-auto-review", [(70_000, 0, 700)])]),
    ("2026/10/04/rollout-2026-10-04T16-00-00-00000000-0000-4000-8000-00000000000c.jsonl",
     "00000000-0000-4000-8000-00000000000c", "acct-synthetic-0001", "2026-10-04T19:00:00Z",
     [("codex-auto-review", [(30_000, 0, 300)])]),
]

for file, sid, creator, ts, turns in SESSIONS:
    meta = {"id": sid, "timestamp": ts, "cwd": "/tmp/synthetic-project", "originator": "codex_cli_rs"}
    if creator:
        meta["creator_account_id"] = creator
    records = [{"type": "session_meta", "timestamp": ts, "payload": meta}]
    for index, (model, usages) in enumerate(turns):
        records.append({"type": "turn_context", "timestamp": ts, "payload": {"model": model}})
        records.append({"type": "event_msg", "timestamp": ts,
                        "payload": {"type": "task_started", "turn_id": f"{sid}-turn-{index}"}})
        for input_tokens, cached, output in usages:
            records.append({"type": "event_msg", "timestamp": ts, "payload": {"type": "token_count", "info": {
                "last_token_usage": {"input_tokens": input_tokens, "cached_input_tokens": cached,
                                     "output_tokens": output}}}})
    path = Path(sys.argv[1]) / "sessions" / file
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text("".join(json.dumps(r) + "\n" for r in records))

H=$(mktemp -d)
mkdir -p "$H/.codex" "$H/.codexbar"
python3 -I gen_fixture.py "$H/.codex"
echo '{"version":1,"providers":[{"id":"codex","enabled":true}]}' > "$H/.codexbar/config.json"
# Custom-rate runs only:
# mkdir -p "$H/Library/Application Support/CodexBar"
# echo '{"codex-auto-review":{"input":1.25,"output":10,"cacheRead":0.125}}' > "$H/Library/Application Support/CodexBar/custom-pricing.json"
env -i HOME="$H" CFFIXED_USER_HOME="$H" CODEX_HOME="$H/.codex" CODEXBAR_CONFIG="$H/.codexbar/config.json" \
  PATH=/usr/bin:/bin SHELL=/bin/sh CODEXBAR_DISABLE_KEYCHAIN_ACCESS=1 CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 \
  "$CLI" cost --provider codex --days 30 --format json --pretty

Real history, before and after, from an earlier head. This run predates rounds 1 and 2 (the uncovered-group fix and the custom-rate precedence) and was not repeated. I ran the in-process scanner over a real ~/.codex history, read-only. Each run used its own temporary cache root and suppressed Keychain access, so it didn't touch the app's live cache. Builds came from main (444821be5) and from this branch at 6ee04fb84, run back to back for month to date. The third run upgraded a copy of the main store in place.

The 731 requests still unpriced are auto-review requests from Oct 1 to 6, before the cutoff. Days with unpriced requests go from Oct 1 to 11 down to Oct 1 to 6.

New tests. Each was written before the fix, and the suites fail with the fix disabled.

• CostUsageCodexAutoReviewTests, after the cutoff in a ChatGPT session:
  • auto-review is priced at $0, keeps its tokens, and gives exact $0 hourly and quota slices;
  • the quota window has complete tokens and cost;
  • a missing-parent fork on the same day keeps fork semantics.
• CostUsageCodexAutoReviewTests, what stays unpriced:
  • auto-review before the cutoff;
  • no creator account, an empty one, or a blank one;
  • an API-key file next to a ChatGPT file on the same day and model (only the ChatGPT one is free);
  • another unpriced model;
  • a group whose rows don't account for the billed tokens, whether reconciliation drops the rows or they undercount the day, despite a catalog price.
• CostUsageCodexAutoReviewTests, pricing details:
  • two requests on either side of the cutoff instant on one day split;
  • a priced model next to free auto-review keeps the exact subtotal;
  • a models.dev price is ignored;
  • an explicit custom rate (bare or openai/ key) prices the request in the day, model breakdown, hourly, and quota slices, and coverage counts it as priced;
  • a custom row missing a consumed token class leaves the request unpriced;
  • with a custom rate, an uncovered group reports exactly what an API-key session reports, the custom-rate aggregate estimate;
  • a Priority-mode free row gets $0 Priority cost;
  • a retained knownCostNanos wins;
  • a row without eventIndex keeps the day unpriced and no slice claims $0.
• CostUsageCodexAutoReviewTests, caching and parsing:
  • a stale parser-revision cache migrates;
  • an appended same-id session_meta with a creator gives the same result from incremental and full parses;
  • two files sharing one session give identical reports across three refreshes.
• SpendDashboardCodexAutoReviewTests builds its report through the scanner. It checks that the dashboard shows no partial cost and no ≥, and that CLI JSON coverage has zero unpriced and unmetered requests.

Commands run:

make check                      # parser hash current (6eedcbb17b6035b4), 0 violations
make test-fast FILTER='CostUsageCodexAutoReviewTests|SpendDashboardCodexAutoReviewTests|CostUsageCodexPartialPricingTests|CostUsageScannerForkSplitTests|CostUsageCodexSourceRecoveryTests|CostUsageStoreTests'   # 137 passed
make test-fast FILTER='CostUsage|SpendDashboard|CLICost|CostHistory|QuotaWindow|InlineUsage'   # 1528 + 68 passed

make test stops at AmpUsageParserTests "parses current amp subscription line and keeps credits detail". That test fails the same way on main (444821be5) and is unrelated to this change.

Merge Danger

Door: two-way

Stored rows don't change. The flag lives in cached session metadata, and the classification happens at report time. Reverting restores the previous rule after the next parser-hash reparse.

Blast Radius: Codex costs

On days with codex-auto-review requests after 2026-10-06 in ChatGPT sessions, those requests move from unpriced to priced at $0. A day with no other unpriced requests stops reading as a partial estimate, and its coverage count follows the fully priced day convention. Dollar totals and token totals don't change. Users with a custom rate for codex-auto-review keep it. API-key sessions, earlier days, other models, fork accounting, and other providers are unchanged. Every user does a one-time bounded reparse of files in the scan window.