fix: show external Codex usage without inflating OpenCode Zen

[Daltonganger]

Summary

• add codex-lb self-service /v1/usage support for external OpenAI API-key Codex accounts and map the returned limits into Codex quota data
• keep OpenCode Zen from counting openai/* spend as pay-as-you-go when OpenCode routes OpenAI through provider.openai.options.baseURL
• add focused TokenManager and decoding support for OpenAI API-key auth plus regression tests for both flows

Testing

• make lint-swift
• xcodebuild -project "CopilotMonitor.xcodeproj" -scheme "CopilotMonitor" -configuration Debug build -quiet

[kargnas]

@op-gg-ai-devops

[op-gg-ai-devops]

✅ AI Code Review Completed

Status	Task	Result
✅	Transform severity/category into shield badges and create final payload	Done
✅	Post review via gh api	Done — 6 inline comments posted
✅	Update status comment on success	Done

Review posted successfully — APPROVED with 6 minor inline comments.

Reviewed with anthropic/claude-opus-4-6

---

📋 View Full Logs

[op-gg-ai-devops]

Review: fix: show external Codex usage without inflating OpenCode Zen

Solid contribution from an external contributor. This PR does three things well:

1. Self-service /v1/usage endpoint for API-key Codex accounts — clean routing logic with proper URL path rewriting, flexible decoding for mixed API response shapes, and a sensible partition of base vs spark limits. The SelfServiceLimit decoder is defensive and handles all the weird type coercion this project's APIs love to throw. Good stuff.

2. OpenCode Zen cost deduction — removing openai/* model costs from the pay-as-you-go total when OpenCode routes through an external Codex LB prevents double-counting. The proportional avgCostPerDay adjustment is mathematically sound.

3. OpenAI API key auth flow — reading openaiAPIKey from both auth.json (as APIKey struct) and ~/.codex/auth.json (as raw OPENAI_API_KEY string) expands auth coverage cleanly.

Tests are thorough — URL rewriting, self-service payload mapping, missing limits, and the OpenCode Zen exclusion logic all have focused test cases. CI is green across build, lint, and test.

A few minor things to consider below, but nothing blocking.

---

Reviewed with anthropic/claude-opus-4-6

---

The bot will automatically re-review when new commits are pushed to this branch. You can also request a review by mentioning @op-gg-ai-devops in a comment. Examples:

• @op-gg-ai-devops review typos
• @op-gg-ai-devops focus on security
• @op-gg-ai-devops check the URL rewriting logic

[op-gg-ai-devops]

❌ AI Code Review Cancelled

Newer commit detected or workflow was manually cancelled.

---

📋 View Logs | 🤖 Model: anthropic/claude-opus-4-6