refactor(auth): trim dead usage formatters and demo (#1031)

* chore(cl-6815): trim unreachable usage formatters, demo, kickoff stub

Decision: usage display is not a product surface — delete fetch/format helpers and their tests rather than wiring them in. Keep only the live auth-header helpers used by oauth-scope-check, renamed usage.ts -> auth-headers.ts. Delete src/tui/demo.ts (410 lines, README-only reference) and the unreferenced workflows/kickoff stub. Net-negative.

* chore: clean post-purge stale references (#1052)

* chore: clean post-purge stale references

* fix(auth): omit empty account id and pin auth header boundaries (#1064)

Author: TheGreatAxios

.oxlintrc.json

@@ -91,7 +91,7 @@
       }
     },
     {
-      "files": ["src/tui/smoke.ts", "src/tui/demo.ts"],
+      "files": ["src/tui/smoke.ts"],
       "rules": {
         "no-console": "off"
       }

scripts/ci-timings.json

@@ -474,7 +474,6 @@
     "src/util/control-char-strip.test.ts": 1,
     "src/util/tool-output-uri.test.ts": 1,
     "tests/helpers/defined.test.ts": 1,
-    "tests/unit/codex-usage.test.ts": 1,
     "tests/unit/context-window.test.ts": 1,
     "tests/unit/director.test.ts": 1,
     "tests/unit/faremeter.test.ts": 1,
@@ -491,7 +490,6 @@
     "tests/unit/tui/theme.test.ts": 1,
     "tests/unit/tui/tool-formatter-web-brand.test.ts": 1,
     "tests/unit/tui/url-links.test.ts": 1,
-    "tests/unit/workflow-kickoff.test.ts": 1,
     "tests/unit/workflows-capabilities.test.ts": 1,
     "src/agent/directors/counsel/package.test.ts": 0,
     "src/inference-abort.test.ts": 0,
@@ -510,7 +508,6 @@
     "tests/unit/mcp-stdio-env.test.ts": 0,
     "tests/unit/provider-protocol-flags.test.ts": 0,
     "tests/unit/run-agent.test.ts": 0,
-    "tests/unit/session/run-sink-exec-status.test.ts": 0,
-    "tests/unit/xai-usage.test.ts": 0
+    "tests/unit/session/run-sink-exec-status.test.ts": 0
   }
 }

src/auth/codex/auth-headers.ts

@@ -0,0 +1,19 @@
+import { CODEX_CLIENT_VERSION, CODEX_ORIGINATOR } from "./constants.js";
+
+export function codexAuthHeadersForToken(
+  token: {
+    readonly access: string;
+    readonly accountId?: string | undefined;
+  },
+  commandName: string,
+): Record<string, string> {
+  const headers: Record<string, string> = {
+    authorization: `Bearer ${token.access}`,
+    originator: CODEX_ORIGINATOR,
+    "user-agent": `${commandName} (${CODEX_ORIGINATOR}/${CODEX_CLIENT_VERSION})`,
+  };
+  // An empty account id carries no identity — sending it as a header value
+  // would label the request with a meaningless id. Only a non-empty id rides.
+  if (token.accountId) headers["chatgpt-account-id"] = token.accountId;
+  return headers;
+}

src/auth/codex/constants.ts

@@ -11,10 +11,8 @@ const codexRedirect = new URL(CODEX_REDIRECT_URI);
 export const CODEX_CALLBACK_PORT = Number(codexRedirect.port);
 export const CODEX_CALLBACK_PATH = codexRedirect.pathname;
 
-// Live usage/quota for the prepaid plan (window %, reset, credits) and the
-// account's available model catalog. The models endpoint requires a
+// The account's available model catalog. The models endpoint requires a
 // client_version query param.
-export const CODEX_USAGE_PATH = "/codex/usage";
 export const CODEX_MODELS_PATH = "/codex/models";
 export const CODEX_CLIENT_VERSION = "0.50.0";