Show local Codex session costs for organization API-key users

[wicolian]

Problem

CodexBar can display account-level Codex quota data through managed accounts, OAuth, CLI, or optional OpenAI web access. Developers who use Codex with an organization-provided API key often cannot access organization billing or usage views because those require administrator permissions.

Codex itself writes local JSONL session records that include the final token ledger for each conversation. CodexBar can use those records to provide a local API-rate estimate without an Admin API key or a billing API request.

Expected behavior

• Keep the selected managed Codex account available for its normal account and quota flows.
• Independently scan $CODEX_HOME/sessions when set, otherwise ~/.codex/sessions.
• Show local 1-day and 30-day token and estimated-cost totals.
• Show conversation and model breakdowns behind those totals.
• Do not present a failed remote quota refresh as a failed local cost estimate.

Local data source

For a session file, the final ledger is the last token_count record:

rg '"type":"token_count"' \
  ~/.codex/sessions/2026/07/14/rollout-2026-07-14T16-38-08-<session>.jsonl \
  | tail -1

The estimator separates cached from uncached input before applying the configured model rates. The displayed amount is an API-rate estimate, not an organization invoice. Negotiated pricing, credits, and taxes can differ.

Privacy

This uses session files already stored locally. It does not upload session content, call the OpenAI billing API, or require administrator access.

Proposed fix

Implemented by PR #2172.

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed July 15, 2026, 5:42 AM ET / 09:42 UTC.

Summary
Current main already scans local Codex sessions, but it deliberately scopes menu cost history to the selected managed account’s CODEX_HOME; the requested independent system-local ledger remains a real product change. Keep this issue paired with the open closing PR, with explicit sign-off on attribution and privacy behavior before landing.

Reproducibility: not applicable. current main behaves as documented by scoping menu cost history to the selected managed account, and the issue requests a new independent presentation mode rather than reporting a broken existing contract.

Ways to help us reproduce this

• Add expected vs actual behavior.

Next step
Do not queue a competing fix branch because the directly linked open PR already owns implementation; maintainers should decide the attribution model and then review or close that PR.

Maintainer decision needed

• Question: Should CodexBar add a system-local cost ledger independent of the selected managed Codex account, and should it supplement or replace the current account-scoped cost view?
• Rationale: Current main intentionally scopes costs to the selected managed account, while the proposal introduces a new data-attribution and privacy model that VISION.md requires maintainers to approve.
• Likely owner: steipete — The strongest history signal ties steipete to the foundational Codex cost scanner, archived-session support, and provider integration decisions.
• Options:
  • Add a separate local ledger (recommended): Keep managed-account quota and cost attribution intact while adding an explicitly labeled, opt-in system-local ledger with independent errors and settings.
  • Replace account-scoped costs: Make system-local sessions the single Codex cost source, accepting changed behavior for existing multi-account users.
  • Retain current account scope: Keep the menu account-scoped and direct organization API-key users to the existing codexbar cost command.

Review details

Best possible solution:

Provide a separately labeled “Local Codex sessions” ledger sourced from the system CODEX_HOME or ~/.codex, keep managed-account quota and identity fields siloed, preserve account-scoped behavior by default or through an explicit mode, and show remote quota failures independently from valid local estimates.

Do we have a high-confidence way to reproduce the issue?

Not applicable: current main behaves as documented by scoping menu cost history to the selected managed account, and the issue requests a new independent presentation mode rather than reporting a broken existing contract.

Is this the best way to solve the issue?

Unclear pending maintainer sign-off: a separate, explicitly labeled local ledger is safer than silently replacing account-scoped behavior, but the linked PR must be reviewed against that product boundary.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• A global local ledger can be visually associated with the selected managed account unless the UI clearly labels it as system-local and independent.
• Changing the established selected-account scope may surprise multi-account users unless the existing account-scoped mode or an explicit migration/default is preserved.
• Conversation breakdowns increase local filesystem and privacy sensitivity even without uploading content, so scan roots and displayed metadata need clear boundaries.

Codex review notes: model internal, reasoning high; reviewed against 2e0154450300.

Label changes

Label changes:

• add P2: This is a bounded, useful cost-visibility improvement for organization API-key users, but it is not an urgent regression or blocked core runtime.
• add impact:ux-friction: Affected users can obtain local costs through the CLI, but the menu’s managed-account scoping obscures the available local estimate and creates avoidable workflow friction.
• add issue-rating: 🌊 off-meta tidepool: Current issue advisory state selects this label.
• add clawsweeper:linked-pr-open: Current issue advisory state selects this label.
• add clawsweeper:no-new-fix-pr: Current issue advisory state selects this label.
• add clawsweeper:needs-product-decision: Current issue advisory state selects this label.

Label justifications:

• P2: This is a bounded, useful cost-visibility improvement for organization API-key users, but it is not an urgent regression or blocked core runtime.
• impact:ux-friction: Affected users can obtain local costs through the CLI, but the menu’s managed-account scoping obscures the available local estimate and creates avoidable workflow friction.

Evidence reviewed

What I checked:

• Current local scanner: Current main includes a local cost fetcher and scanner for native Codex JSONL sessions, with model-aware token and estimated-cost aggregation. (Sources/CodexBarCore/CostUsageFetcher.swift, 2e0154450300)
• Documented session roots: Current documentation confirms CodexBar scans Codex sessions and archives from CODEX_HOME or ~/.codex. (docs/codex.md:357, 2e0154450300)
• Existing CLI workaround: Current documentation exposes codexbar cost as a local cost command, so the missing behavior is specifically managed-account menu and settings integration rather than the underlying scanner. (docs/cli.md, 2e0154450300)
• Deliberate account scope: Release history records that v0.26.0 intentionally scoped local Codex cost history to the selected managed account's CODEX_HOME, making the requested decoupling a behavior-direction change rather than a regression fix. (CHANGELOG.md:1007, 2e0154450300)
• Open implementation candidate: The directly linked open PR proposes the independent scanner toggle, separate error handling, conversation/model breakdowns, and live screenshot/CLI proof; because it uses closing syntax, this issue should remain open until that PR merges or is closed. (4c3f7c8b03c2)
• Vision fit and sign-off: VISION.md includes spend and privacy-first local data handling in CodexBar's control-surface scope while requiring sign-off for new features and behavior affecting data storage or privacy. (VISION.md:237, 2e0154450300)

Likely related people:

• steipete: Repository history attributes archived Codex session scanning and multiple foundational Codex cost/provider integrations to steipete, making this the strongest available decision-routing signal. (role: feature owner and recent integrator; confidence: high; commits: cf081b6, c23edb9; files: Sources/CodexBarCore/CostUsageFetcher.swift, Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift, docs/codex.md)
• iam-brain: Recent release history repeatedly credits iam-brain for per-model counts, model pricing, tiered pricing, and cost breakdowns in this surface. (role: cost-history contributor; confidence: medium; files: Sources/CodexBarCore/Vendored/CostUsage/CostUsagePricing.swift, Tests/CodexBarTests/CostUsagePricingTests.swift, Tests/CodexBarTests/CostUsageScannerPriorityTests.swift)
• ThiagoCAltoe: Release history links ThiagoCAltoe to managed-account source routing and CLI cost-serving work adjacent to the account-versus-local-ledger boundary. (role: adjacent managed-account contributor; confidence: medium; files: Sources/CodexBar/UsageStore+TokenCost.swift, Sources/CodexBarCLI, Tests/CodexBarTests)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Fixed by #2172 (merge 63215da4257565ff65c10a7d57d2550fc265011b). Organization API-key users can enable Codex > Local session cost estimates. The ledger reads selected local session roots only, uses cached/bundled pricing without network refresh, and reuses corrected #2228 fork accounting. Verified by focused scanner/settings/cache/hydration tests, make check, full tests, and green exact-head CI run 29565191154.