feat: expose token usage as step outputs

[adamhenson]

Closes #65

Summary

Adds three new step outputs — input-tokens, output-tokens, cached-input-tokens — by reading the rollout JSONL that codex exec already writes to $CODEX_HOME/sessions/.

Note on prior art: PR #62 attempted something similar by tee-ing stdout to a log file. A collaborator closed it with the suggestion:

"there should be an optional flag to codex exec that takes a path to a file where the token info should be recorded and we should write it as JSON or some format that can be read programmatically."

This PR takes that approach — the Codex CLI already writes a structured JSONL rollout file to $CODEX_HOME/sessions/YYYY/MM/DD/rollout-<timestamp>-<uuid>.jsonl as part of normal operation. The last token_count line in that file contains the cumulative totals:

{"type":"event_msg","payload":{"type":"token_count","info":{"total_token_usage":{"input_tokens":1234,"output_tokens":56,"cached_input_tokens":789}}}}

We read that file, not stdout. No new CLI flags are needed.

What changed

• src/extractTokenOutputs.ts — walks $CODEX_HOME/sessions/ for the most recently modified .jsonl, scans for the last token_count event, sets the three step outputs via @actions/core. Exits silently if no file or token data is found.
• src/main.ts — new extract-token-outputs CLI command wired to the above.
• action.yml — three new outputs: entries + a new extract_tokens step that runs immediately after run_codex (same if: condition).

Outputs are empty strings when token data is unavailable (e.g. unprivileged-user strategy where the rollout may not be readable post-drop-sudo). Non-breaking — existing workflows are unaffected.

Usage

- uses: openai/codex-action@main
  id: codex
  with:
    prompt: "Fix the failing tests"
    openai-api-key: ${{ secrets.OPENAI_API_KEY }}

- run: |
    echo "Input:  ${{ steps.codex.outputs.input-tokens }}"
    echo "Output: ${{ steps.codex.outputs.output-tokens }}"
    echo "Cached: ${{ steps.codex.outputs.cached-input-tokens }}"

Testing

• npm run build && npm run check pass cleanly
• Verified bundle includes new command: node dist/main.js --help | grep extract-token-outputs

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[adamhenson]

I have read the CLA Document and I hereby sign the CLA