@hank-warren/pi-statusline 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @hank-warren/pi-statusline
 
+## 0.5.0
+
+### Minor Changes
+
+- 0e9400e: Point each subscription usage meter at the account behind the main model, so additional provider logins report the headroom actually being spent. Families the main model does not belong to keep showing their base account, and a login used only for background work is never polled.
+
+  The host-wide usage cache is now keyed by credential id rather than by provider family. Keyed by family, two sessions on two different Anthropic accounts each looked like an account switch to the other, evicting each other's values and re-polling every cycle. Cache files written by earlier versions are discarded, costing one extra poll on upgrade.
+
+## 0.4.2
+
+### Patch Changes
+
+- 1e25d6b: Guard against a setting being added without being registered for persistence. `SETTING_KEYS` feeds the per-key diff behind every save, so a key missing from it applied live and then silently failed to persist. Omitting one is now a `tsc` error naming the key, plus a test asserting the list matches `defaultSettings()`. Adds an "Adding a setting" checklist and the cross-version compatibility rules to the README.
+
 ## 0.4.1
 
 ### Patch Changes

package/README.md

@@ -30,6 +30,26 @@ Settings live in a single global file, `~/.pi/agent/statusline-settings.json`, w
 
 Saves are per-key rather than whole-file: a change writes only the fields it actually touched over whatever is on disk at that moment. Sessions load settings once at startup, so a whole-file write would let a session that started hours ago revert edits it never saw — including hand edits and changes made in another session. Opening `/statusline` also re-reads the file first, so the menu always edits current state. Two sessions changing the *same* field are still last-writer-wins; everything else merges.
 
+### Adding a setting
+
+A setting is persisted, validated, diffed, and rendered in separate places, so add it to all of them:
+
+1. `StatuslineSettings` in `settings.ts` — plus `BOOLEAN_SETTING_KEYS` if it is a toggle.
+2. `defaultSettings()`.
+3. `normalizeSettings()` — the `known` key set, and a parse branch that falls back to the default for an invalid value rather than discarding the whole file.
+4. `serializeSettings()` — write it only when it differs from its default, keeping the file sparse.
+5. `SETTING_KEYS`.
+6. A row in `buildSettingItems()` and a branch in `applySettingChange()` in `settings-menu.ts`, placed in the order the element renders.
+7. Live-apply handling in `applySettings()` in `index.ts`, if the change needs more than a repaint (disposing a poller, forcing a full redraw on a row-count change).
+
+Steps 1 and 5 are enforced: omitting the key from `SETTING_KEYS` fails `npm run typecheck` by name, and a test asserts it matches the keys of `defaultSettings()`. Nothing enforces steps 3, 4, 6 or 7 — a setting missing from `serializeSettings` applies live and never persists.
+
+Compatibility rules, because old and new versions share one file:
+
+- **Never change a key's type or meaning — add a sibling key.** This is why `showCacheCelebration` stayed a boolean when it gained animation styles: an older version reading a repurposed key falls back to its default and can write that fallback back.
+- **Unknown keys survive an older version; unknown *values* do not.** A theme name a reader does not recognise falls back to `default`, and a whole-file write from that reader drops the choice. Extending a cosmetic enum is fine; encoding behaviour in one is riskier than adding a key.
+- **Keep settings independent.** Per-key saves mean two fields can be written by different sessions at different times, so resolve any relationship between settings at render time, not on disk.
+
 ## Themes
 
 | Name | Notes |
@@ -57,7 +77,19 @@ Numbers are colored by remaining headroom: green above 60, yellow 41–60, orang
 
 Usage is fetched from the providers' own usage endpoints with Pi's stored tokens — read-only; tokens are never refreshed or written. Fetches happen on session start and after each turn, throttled to at most once every five minutes (the Anthropic usage endpoint rate-limits aggressively), and are strictly best-effort: on any failure the last-known value is kept, and providers without credentials (or before the first successful fetch) are simply omitted, leaving the statusline exactly as before. While a provider that *does* have credentials still has no value, the throttle drops to 30 seconds — Pi only refreshes an expired OAuth access token when that provider is first used, so a session starting with a stale Anthropic token would otherwise show no Claude meter for a full interval.
 
-Polling is host-wide, not per-session. Usage percentages describe the account rather than the session, and a busy machine runs dozens of pi processes, so every process shares `~/.pi/agent/statusline-usage.json`: it holds the last good snapshot plus the time the last poll was *started*, written atomically via a temp file and rename. A session adopts the cached values on its first refresh — so the meters are populated before it has issued a single request — and only polls when that shared timestamp is older than the interval. A provider answering `429` is parked for fifteen minutes (tracked per provider, so a rate-limited Anthropic never stops codex from updating) and stops counting as pending, since retrying harder is what earns the rate limit in the first place. Each provider's cache entry is keyed to a fingerprint (a sha256 prefix, never the token itself) of the credentials that fetched it: switching accounts — or rotating a token — discards that provider's cached numbers and backoff and polls immediately, so an exhausted old account's meters never masquerade as the new account's. Requires a Nerd Font new enough to include the codicon brand glyphs (v3.5.0+); older fonts render them as replacement boxes.
+### Which account each meter shows
+
+With a single login per provider — the ordinary case, including logging out and back in as a different Anthropic account — nothing here applies: each meter shows that provider's account, exactly as before.
+
+When [`@hank-warren/pi-multi-login`](../pi-multi-login/README.md) has registered additional logins (`anthropic-work`, `openai-codex-alt`), a provider family can hold several accounts at once. Each meter then shows **the account behind the main model**, falling back to the base account (`anthropic`, `openai-codex`) when the main model belongs to the other family. So switching the main model between two Claude logins swaps the Claude meter and leaves the Codex meter alone, and a login used only for background work — such as a `pi-auto-permissions` reviewer, which is never the main model — is never polled at all. There is deliberately no marker for *which* account is shown: the meter tracks whatever you are actually spending.
+
+### Polling and the shared cache
+
+Polling is host-wide, not per-session. Usage percentages describe the account rather than the session, and a busy machine runs dozens of pi processes, so every process shares `~/.pi/agent/statusline-usage.json`, written atomically via a temp file and rename. It is keyed by **credential id**, one entry per account, each holding that account's last good values plus the time its last poll was *started*. A session adopts the cached values for its selected accounts on first refresh — so the meters are populated before it has issued a single request, and switching back to an account polled earlier repaints with no request at all — and only polls an account whose timestamp is older than the interval. Keying by account rather than by provider family is what lets two sessions on two different Anthropic logins coexist: keyed by family, each looked like an account switch to the other, so they evicted each other's values and re-polled every cycle.
+
+An account answering `429` is parked for fifteen minutes (tracked per account, so a rate-limited Anthropic never stops codex from updating) and stops counting as pending, since retrying harder is what earns the rate limit in the first place. Every cache entry is keyed to a fingerprint (a sha256 prefix, never the token itself) of the credential that fetched it: switching accounts — or rotating a token — discards that entry's numbers and backoff and polls immediately, so an exhausted old account's meters never masquerade as the new account's. A logged-out account fails the same check, so the file garbage-collects itself.
+
+Requires a Nerd Font new enough to include the codicon brand glyphs (v3.5.0+); older fonts render them as replacement boxes.
 
 ## Cache-hit celebration
 

package/index.ts

@@ -264,7 +264,10 @@ export default function statuslineExtension(pi: ExtensionAPI): void {
 		cwdStatusAbort = new AbortController();
 		cwdStatusInFlight = undefined;
 		runInBackground(refreshCwdStatus(ctx));
-		if (settings.showUsage) runInBackground(usageTracker.refresh());
+		if (settings.showUsage) {
+			usageTracker.setActiveProvider(ctx.model?.provider);
+			runInBackground(usageTracker.refresh());
+		}
 		// A hidden worktree line must not pay for git/gh polling.
 		if (!settings.showWorktrees) return;
 		const next = new SessionWorktreeTracker({
@@ -446,9 +449,20 @@ export default function statuslineExtension(pi: ExtensionAPI): void {
 		requestRender?.();
 		runInBackground(refreshCwdStatus(ctx));
 		if (tracker) runInBackground(tracker.refresh());
-		if (settings.showUsage) runInBackground(usageTracker.refresh());
+		if (settings.showUsage) {
+			usageTracker.setActiveProvider(ctx.model?.provider);
+			runInBackground(usageTracker.refresh());
+		}
+	});
+	// The meters follow the main model's account, so a switch between two logins
+	// of the same provider family has to re-point the tracker before it repaints.
+	pi.on("model_select", (event) => {
+		if (settings.showUsage) {
+			usageTracker.setActiveProvider(event.model.provider);
+			runInBackground(usageTracker.refresh());
+		}
+		requestRender?.();
 	});
-	pi.on("model_select", () => requestRender?.());
 	pi.on("session_tree", (_event, ctx) => resetTracker(ctx));
 	pi.on("session_shutdown", () => {
 		cacheCelebration.dispose();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-statusline",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Compact Pi footer statusline with Git/worktree context, token usage, and neon celebrations for exceptional prompt-cache hits.",
   "type": "module",
   "keywords": [

package/settings.ts

@@ -176,6 +176,17 @@ export const SETTING_KEYS = [
 
 export type SettingKey = (typeof SETTING_KEYS)[number];
 
+/**
+ * Compile-time completeness guard.
+ *
+ * `satisfies readonly (keyof StatuslineSettings)[]` above only proves the listed
+ * keys are real; it does not prove every key is listed. That gap is silent and
+ * expensive: SETTING_KEYS feeds changedSettingKeys, which feeds every save, so a
+ * setting missing from it works all session and then vanishes on restart.
+ */
+type Unlisted<Key extends never> = Key;
+type _EverySettingKeyIsListed = Unlisted<Exclude<keyof StatuslineSettings, SettingKey>>;
+
 /** The keys one edit actually touched; the unit of a merging save. */
 export function changedSettingKeys(
 	previous: StatuslineSettings,

package/usage.ts

@@ -25,7 +25,7 @@ export const USAGE_REFRESH_INTERVAL_MS = 5 * 60_000;
  */
 export const USAGE_RETRY_INTERVAL_MS = 30_000;
 /**
- * How long a provider is left alone after it answers 429. Polls are host-wide
+ * How long an account is left alone after it answers 429. Polls are host-wide
  * (see the shared cache below), so a rate limit means the provider itself wants
  * a break rather than that we are racing ourselves.
  */
@@ -118,124 +118,167 @@ export interface UsageTrackerOptions {
 	fetchFn?: FetchFn;
 	onChange?: () => void;
 	now?: () => number;
+	/** Provider id of the session's main model; selects which account is polled. */
+	activeProvider?: string;
 }
 
 type ProviderKey = "claude" | "codex";
 
 const PROVIDER_KEYS = ["claude", "codex"] as const;
 
-/** Non-reversible per-provider credential fingerprints; never raw tokens. */
+/** Provider ids whose additional logins (`${base}-${suffix}`) share a meter. */
+export const USAGE_BASE_PROVIDERS: Record<ProviderKey, string> = {
+	claude: "anthropic",
+	codex: "openai-codex",
+};
+
+/** Credential id polled for each family. */
+export type UsageAccounts = Record<ProviderKey, string>;
+
+function inFamily(providerId: string | undefined, base: string): boolean {
+	return providerId === base || (providerId !== undefined && providerId.startsWith(`${base}-`));
+}
+
+/** The family an account id belongs to, or undefined when it is neither. */
+function familyOf(accountId: string): ProviderKey | undefined {
+	return PROVIDER_KEYS.find((key) => inFamily(accountId, USAGE_BASE_PROVIDERS[key]));
+}
+
+/**
+ * Choose the account whose meter each family shows.
+ *
+ * Additional logins (@hank-warren/pi-multi-login) mean a family can hold several
+ * accounts at once. The one worth showing is the one the session is actually
+ * spending: the provider of the main model. Every other family falls back to its
+ * base account, which is what makes a backup provider's meter stay visible while
+ * you are not using it — and what keeps a dedicated background-reviewer login
+ * (never the main model) from ever being polled.
+ */
+export function resolveUsageAccounts(activeProvider: string | undefined): UsageAccounts {
+	const accounts = { ...USAGE_BASE_PROVIDERS };
+	for (const key of PROVIDER_KEYS) {
+		if (inFamily(activeProvider, USAGE_BASE_PROVIDERS[key])) accounts[key] = activeProvider as string;
+	}
+	return accounts;
+}
+
+/** Non-reversible per-family credential fingerprints; never raw tokens. */
 type ProviderIdentities = Partial<Record<ProviderKey, string>>;
 
 function fingerprint(material: string): string {
 	return createHash("sha256").update(material).digest("hex").slice(0, 16);
 }
 
+interface AuthEntry {
+	access?: unknown;
+	accountId?: unknown;
+}
+
+type AuthEntries = Record<string, AuthEntry | undefined>;
+
 /**
- * Fingerprint the credentials each provider would be polled with. Usage
- * percentages belong to an account, so a cached value is only trustworthy
- * while the credentials that produced it are still the ones in auth.json —
- * after an account switch, yesterday's "1% left" is somebody else's meter.
+ * Fingerprint the credential an account would be polled with, or undefined when
+ * it cannot be polled at all. Usage percentages belong to an account, so a
+ * cached value is only trustworthy while the credential that produced it is
+ * still the one in auth.json — after an account switch, yesterday's "1% left"
+ * is somebody else's meter.
  */
-function credentialIdentities(auth: AuthEntries): ProviderIdentities {
+function accountFingerprint(auth: AuthEntries, accountId: string): string | undefined {
+	const entry = auth[accountId];
+	const access = entry?.access;
+	if (typeof access !== "string" || access.length === 0) return undefined;
+	if (familyOf(accountId) === "codex") {
+		const account = entry?.accountId;
+		if (typeof account !== "string" || account.length === 0) return undefined;
+		return fingerprint(`${access}\n${account}`);
+	}
+	return fingerprint(access);
+}
+
+function hasAuth(auth: AuthEntries, accountId: string): boolean {
+	return accountFingerprint(auth, accountId) !== undefined;
+}
+
+function credentialIdentities(auth: AuthEntries, accounts: UsageAccounts): ProviderIdentities {
 	const identities: ProviderIdentities = {};
-	if (hasClaudeAuth(auth)) identities.claude = fingerprint(String(auth.anthropic?.access));
-	if (hasCodexAuth(auth)) {
-		const entry = auth["openai-codex"];
-		identities.codex = fingerprint(`${entry?.access as string}\n${entry?.accountId as string}`);
+	for (const key of PROVIDER_KEYS) {
+		const value = accountFingerprint(auth, accounts[key]);
+		if (value !== undefined) identities[key] = value;
 	}
 	return identities;
 }
 
+/** One account's shared poll state. Only the family's own field is ever set. */
+interface UsageAccountEntry {
+	/** Credential fingerprint the stored values were fetched with. */
+	identity: string;
+	/** Last time any process started a poll for this account. */
+	attemptedAt: number;
+	/** Absolute time before which a rate-limited account must not be polled. */
+	backoff?: number;
+	claude?: UsageSnapshot["claude"];
+	codex?: UsageSnapshot["codex"];
+}
+
 /**
  * Host-wide poll state shared by every pi process. Usage percentages are a
- * property of the account, not of a session, so one poll per interval per host
- * is both sufficient and necessary: a busy host runs dozens of pi processes, and
- * per-process polling stampedes the endpoints into rate limiting everyone.
+ * property of the account, not of a session, so one poll per interval per
+ * account is both sufficient and necessary: a busy host runs dozens of pi
+ * processes, and per-process polling stampedes the endpoints into rate limiting
+ * everyone.
+ *
+ * Keyed by credential id rather than by family, because two sessions on the
+ * same host may legitimately be using two different Anthropic accounts. Keying
+ * by family made each of them look like an account switch to the other, so they
+ * evicted each other's values and re-polled on every cycle — the exact
+ * stampede this cache exists to prevent.
  */
 interface UsageCache {
-	/** Last time any process started a poll; gates the shared throttle. */
-	attemptedAt: number;
-	/** Absolute times before which a rate-limited provider must not be polled. */
-	backoff: Partial<Record<ProviderKey, number>>;
-	snapshot: UsageSnapshot;
-	/** Credential fingerprints the snapshot was fetched with. */
-	identity: ProviderIdentities;
+	accounts: Record<string, UsageAccountEntry>;
 }
 
-const EMPTY_CACHE: UsageCache = {
-	attemptedAt: Number.NEGATIVE_INFINITY,
-	backoff: {},
-	snapshot: {},
-	identity: {},
-};
+const EMPTY_CACHE: UsageCache = { accounts: {} };
 
 /**
- * Drop cached values that were fetched with different credentials. A token
- * rotation looks the same as an account switch here; the cost of treating it
- * as one is a single immediate re-poll, while trusting a stale identity means
- * showing another account's numbers as if they were current.
+ * Drop entries whose credential no longer matches auth.json. A token rotation
+ * looks the same as an account switch here; the cost of treating it as one is a
+ * single immediate re-poll, while trusting a stale identity means showing
+ * another account's numbers as if they were current. Logged-out accounts fail
+ * the same check, so the file garbage-collects itself.
  */
-function pruneCache(cache: UsageCache, identity: ProviderIdentities): UsageCache {
-	const snapshot = { ...cache.snapshot };
-	const backoff = { ...cache.backoff };
+function pruneCache(cache: UsageCache, auth: AuthEntries): UsageCache {
+	const accounts: Record<string, UsageAccountEntry> = {};
 	let changed = false;
-	for (const key of PROVIDER_KEYS) {
-		if (cache.identity[key] === identity[key]) continue;
-		if (snapshot[key] !== undefined || backoff[key] !== undefined) changed = true;
-		delete snapshot[key];
-		delete backoff[key];
+	for (const [accountId, entry] of Object.entries(cache.accounts)) {
+		if (accountFingerprint(auth, accountId) === entry.identity) accounts[accountId] = entry;
+		else changed = true;
 	}
-	if (!changed) return cache;
-	// The pruned values also claimed the shared throttle slot; the new account's
-	// first poll must not wait out a window started for somebody else.
-	return { attemptedAt: Number.NEGATIVE_INFINITY, backoff, snapshot, identity };
+	return changed ? { accounts } : cache;
 }
 
 function parseUsageCache(json: unknown): UsageCache | undefined {
 	if (typeof json !== "object" || json === null) return undefined;
-	const body = json as { attemptedAt?: unknown; backoff?: unknown; snapshot?: unknown; identity?: unknown };
-	if (typeof body.attemptedAt !== "number" || !Number.isFinite(body.attemptedAt)) return undefined;
-	const snapshot = typeof body.snapshot === "object" && body.snapshot !== null ? (body.snapshot as UsageSnapshot) : {};
-	const backoff: UsageCache["backoff"] = {};
-	const identity: ProviderIdentities = {};
-	for (const key of PROVIDER_KEYS) {
-		if (typeof body.backoff === "object" && body.backoff !== null) {
-			const value = (body.backoff as Record<string, unknown>)[key];
-			if (typeof value === "number" && Number.isFinite(value)) backoff[key] = value;
-		}
-		if (typeof body.identity === "object" && body.identity !== null) {
-			const value = (body.identity as Record<string, unknown>)[key];
-			if (typeof value === "string") identity[key] = value;
-		}
+	const rawAccounts = (json as { accounts?: unknown }).accounts;
+	if (typeof rawAccounts !== "object" || rawAccounts === null) return undefined;
+	const accounts: Record<string, UsageAccountEntry> = {};
+	for (const [accountId, value] of Object.entries(rawAccounts as Record<string, unknown>)) {
+		if (typeof value !== "object" || value === null) continue;
+		const body = value as Record<string, unknown>;
+		if (typeof body.identity !== "string") continue;
+		if (typeof body.attemptedAt !== "number" || !Number.isFinite(body.attemptedAt)) continue;
+		const entry: UsageAccountEntry = { identity: body.identity, attemptedAt: body.attemptedAt };
+		if (typeof body.backoff === "number" && Number.isFinite(body.backoff)) entry.backoff = body.backoff;
+		if (typeof body.claude === "object" && body.claude !== null) entry.claude = body.claude as UsageSnapshot["claude"];
+		if (typeof body.codex === "object" && body.codex !== null) entry.codex = body.codex as UsageSnapshot["codex"];
+		accounts[accountId] = entry;
 	}
-	return { attemptedAt: body.attemptedAt, backoff, snapshot, identity };
-}
-
-interface AuthEntries {
-	anthropic?: { access?: unknown };
-	"openai-codex"?: { access?: unknown; accountId?: unknown };
-}
-
-function hasClaudeAuth(auth: AuthEntries): boolean {
-	const access = auth.anthropic?.access;
-	return typeof access === "string" && access.length > 0;
-}
-
-function hasCodexAuth(auth: AuthEntries): boolean {
-	const entry = auth["openai-codex"];
-	return (
-		typeof entry?.access === "string" &&
-		entry.access.length > 0 &&
-		typeof entry.accountId === "string" &&
-		entry.accountId.length > 0
-	);
+	return { accounts };
 }
 
 /**
  * Best-effort subscription usage poller. Reads Pi's auth.json for tokens (never
  * refreshes them), fetches both usage endpoints, and keeps the last-known good
- * value per provider. Refreshes are throttled and must never throw.
+ * value per account. Refreshes are throttled and must never throw.
  */
 export class UsageTracker {
 	private readonly authPath: string;
@@ -245,9 +288,10 @@ export class UsageTracker {
 	private readonly now: () => number;
 	private current: UsageSnapshot = {};
 	private identities: ProviderIdentities = {};
+	private activeProvider: string | undefined;
 	private awaitingProvider = true;
 	private readonly rateLimited = new Set<ProviderKey>();
-	private lastAttempt = Number.NEGATIVE_INFINITY;
+	private lastAttempt: Record<string, number> = {};
 	private inFlight: Promise<void> | undefined;
 
 	constructor(options: UsageTrackerOptions = {}) {
@@ -256,12 +300,22 @@ export class UsageTracker {
 		this.fetchFn = options.fetchFn ?? ((url, init) => fetch(url, init));
 		this.onChange = options.onChange;
 		this.now = options.now ?? Date.now;
+		this.activeProvider = options.activeProvider;
 	}
 
 	snapshot(): UsageSnapshot {
 		return this.current;
 	}
 
+	/**
+	 * Point the meters at the session's main model. A switch between two accounts
+	 * in the same family changes which one is displayed; the next refresh adopts
+	 * the new account's cached value if there is one, and polls otherwise.
+	 */
+	setActiveProvider(providerId: string | undefined): void {
+		this.activeProvider = providerId;
+	}
+
 	/**
 	 * Interval until the next allowed attempt: the short retry window while a
 	 * credentialed provider is still missing a value, the full interval otherwise.
@@ -285,58 +339,89 @@ export class UsageTracker {
 	}
 
 	/**
-	 * One refresh cycle: adopt whatever another process has already published,
-	 * then poll only if the shared throttle allows it.
+	 * One refresh cycle: adopt whatever another process has already published for
+	 * the selected accounts, then poll only those the shared throttle allows.
 	 */
 	private async performRefresh(): Promise<void> {
 		const auth = (await this.readAuth()) ?? {};
-		const identity = credentialIdentities(auth);
-		const cache = pruneCache((await this.readCache()) ?? EMPTY_CACHE, identity);
-		this.pruneCurrent(identity);
+		const accounts = resolveUsageAccounts(this.activeProvider);
+		const identity = credentialIdentities(auth, accounts);
+		const cache = pruneCache((await this.readCache()) ?? EMPTY_CACHE, auth);
+		this.pruneCurrent(identity, accounts);
 		// Another process's values are as good as ours and cost no request, so a new
-		// session shows real numbers on its very first render.
-		this.publish(this.merge(cache.snapshot, auth), auth, cache);
+		// session — or a switch back to an account polled earlier — shows real
+		// numbers on its very first render.
+		this.publish(this.merge(cachedSnapshot(cache, accounts), auth, accounts), auth, accounts, cache);
 
 		const now = this.now();
-		const lastAttempt = Math.max(this.lastAttempt, cache.attemptedAt);
-		if (now - lastAttempt < this.currentInterval()) return;
-		const claudeAllowed = hasClaudeAuth(auth) && now >= (cache.backoff.claude ?? Number.NEGATIVE_INFINITY);
-		const codexAllowed = hasCodexAuth(auth) && now >= (cache.backoff.codex ?? Number.NEGATIVE_INFINITY);
-		if (!claudeAllowed && !codexAllowed) return;
-
-		this.lastAttempt = now;
-		// Claim the slot before fetching so sibling processes skip this window even
+		const interval = this.currentInterval();
+		const pollable: Partial<Record<ProviderKey, string>> = {};
+		for (const key of PROVIDER_KEYS) {
+			const accountId = accounts[key];
+			if (!hasAuth(auth, accountId)) continue;
+			const entry = cache.accounts[accountId];
+			if (now < (entry?.backoff ?? Number.NEGATIVE_INFINITY)) continue;
+			const lastAttempt = Math.max(
+				this.lastAttempt[accountId] ?? Number.NEGATIVE_INFINITY,
+				entry?.attemptedAt ?? Number.NEGATIVE_INFINITY,
+			);
+			if (now - lastAttempt < interval) continue;
+			pollable[key] = accountId;
+		}
+		if (pollable.claude === undefined && pollable.codex === undefined) return;
+
+		// Claim each slot before fetching so sibling processes skip this window even
 		// if our own request is slow or fails outright. The claim carries the fresh
 		// identity so siblings do not re-prune and stampede the same window.
-		await this.writeCache({ ...cache, attemptedAt: now, identity });
+		const claimed = { ...cache.accounts };
+		for (const key of PROVIDER_KEYS) {
+			const accountId = pollable[key];
+			if (accountId === undefined) continue;
+			this.lastAttempt[accountId] = now;
+			claimed[accountId] = {
+				...claimed[accountId],
+				identity: identity[key] as string,
+				attemptedAt: now,
+			};
+		}
+		await this.writeCache({ accounts: claimed });
 
 		const [claude, codex] = await Promise.all([
-			claudeAllowed ? this.fetchClaude(auth) : Promise.resolve(undefined),
-			codexAllowed ? this.fetchCodex(auth) : Promise.resolve(undefined),
+			pollable.claude === undefined ? Promise.resolve(undefined) : this.fetchClaude(auth, pollable.claude),
+			pollable.codex === undefined ? Promise.resolve(undefined) : this.fetchCodex(auth, pollable.codex),
 		]);
-		const backoff = { ...cache.backoff };
-		for (const key of ["claude", "codex"] as const) {
-			if (this.rateLimited.has(key)) backoff[key] = now + USAGE_RATE_LIMIT_BACKOFF_MS;
-			else if ((key === "claude" ? claude : codex) !== undefined) delete backoff[key];
+
+		const updatedAccounts = { ...claimed };
+		for (const key of PROVIDER_KEYS) {
+			const accountId = pollable[key];
+			if (accountId === undefined) continue;
+			const entry: UsageAccountEntry = { ...(updatedAccounts[accountId] as UsageAccountEntry) };
+			const value = key === "claude" ? claude : codex;
+			if (this.rateLimited.has(key)) entry.backoff = now + USAGE_RATE_LIMIT_BACKOFF_MS;
+			else if (value !== undefined) delete entry.backoff;
+			// A failed fetch leaves the last-known value in place rather than blanking
+			// the meter for whatever caused one bad response.
+			if (claude !== undefined && key === "claude") entry.claude = claude;
+			if (codex !== undefined && key === "codex") entry.codex = codex;
+			updatedAccounts[accountId] = entry;
 		}
 		this.rateLimited.clear();
 
-		const next = this.merge({ claude, codex }, auth);
-		const updated: UsageCache = { attemptedAt: now, backoff, snapshot: next, identity };
-		this.publish(next, auth, updated);
+		const updated: UsageCache = { accounts: updatedAccounts };
+		this.publish(this.merge({ claude, codex }, auth, accounts), auth, accounts, updated);
 		await this.writeCache(updated);
 	}
 
 	/**
 	 * Drop in-memory values fetched with previous credentials so merge() cannot
 	 * resurrect another account's numbers, and let the changed identity reopen
-	 * this process's own throttle gate.
+	 * this process's own throttle gate for the newly selected account.
 	 */
-	private pruneCurrent(identity: ProviderIdentities): void {
+	private pruneCurrent(identity: ProviderIdentities, accounts: UsageAccounts): void {
 		const changedKeys = PROVIDER_KEYS.filter((key) => this.identities[key] !== identity[key]);
 		this.identities = identity;
 		if (changedKeys.length === 0) return;
-		this.lastAttempt = Number.NEGATIVE_INFINITY;
+		for (const key of changedKeys) delete this.lastAttempt[accounts[key]];
 		if (!changedKeys.some((key) => this.current[key] !== undefined)) return;
 		const next = { ...this.current };
 		for (const key of changedKeys) delete next[key];
@@ -346,17 +431,17 @@ export class UsageTracker {
 	}
 
 	/**
-	 * Layer fresh values over the last-known ones and drop providers without
-	 * credentials: a logged-out provider must disappear immediately, while a
-	 * failed fetch keeps whatever we last saw.
+	 * Layer fresh values over the last-known ones and drop families whose selected
+	 * account has no credentials: a logged-out account must disappear immediately,
+	 * while a failed fetch keeps whatever we last saw.
 	 */
-	private merge(incoming: UsageSnapshot, auth: AuthEntries): UsageSnapshot {
+	private merge(incoming: UsageSnapshot, auth: AuthEntries, accounts: UsageAccounts): UsageSnapshot {
 		const next: UsageSnapshot = {};
-		if (hasClaudeAuth(auth)) {
+		if (hasAuth(auth, accounts.claude)) {
 			const claude = incoming.claude ?? this.current.claude;
 			if (claude) next.claude = claude;
 		}
-		if (hasCodexAuth(auth)) {
+		if (hasAuth(auth, accounts.codex)) {
 			const codex = incoming.codex ?? this.current.codex;
 			if (codex) next.codex = codex;
 		}
@@ -364,13 +449,16 @@ export class UsageTracker {
 	}
 
 	/** Adopt a snapshot, recompute the retry gate, and repaint only on a change. */
-	private publish(next: UsageSnapshot, auth: AuthEntries, cache: UsageCache): void {
+	private publish(next: UsageSnapshot, auth: AuthEntries, accounts: UsageAccounts, cache: UsageCache): void {
 		const now = this.now();
-		// A provider serving 429s is not "pending": retrying it faster is exactly
+		// An account serving 429s is not "pending": retrying it faster is exactly
 		// what got us rate limited, so it must not hold the short window open.
-		this.awaitingProvider =
-			(hasClaudeAuth(auth) && next.claude === undefined && now >= (cache.backoff.claude ?? 0)) ||
-			(hasCodexAuth(auth) && next.codex === undefined && now >= (cache.backoff.codex ?? 0));
+		this.awaitingProvider = PROVIDER_KEYS.some(
+			(key) =>
+				hasAuth(auth, accounts[key]) &&
+				next[key] === undefined &&
+				now >= (cache.accounts[accounts[key]]?.backoff ?? 0),
+		);
 		if (JSON.stringify(next) === JSON.stringify(this.current)) return;
 		this.current = next;
 		this.onChange?.();
@@ -418,16 +506,14 @@ export class UsageTracker {
 		}
 	}
 
-	private async fetchClaude(auth: AuthEntries): Promise<UsageSnapshot["claude"] | undefined> {
-		if (!hasClaudeAuth(auth)) return undefined;
+	private async fetchClaude(auth: AuthEntries, accountId: string): Promise<UsageSnapshot["claude"] | undefined> {
+		const access = auth[accountId]?.access;
+		if (typeof access !== "string" || access.length === 0) return undefined;
 		try {
 			return parseClaudeUsage(
 				await this.fetchJson(
 					CLAUDE_USAGE_URL,
-					{
-						Authorization: `Bearer ${auth.anthropic?.access as string}`,
-						"anthropic-beta": "oauth-2025-04-20",
-					},
+					{ Authorization: `Bearer ${access}`, "anthropic-beta": "oauth-2025-04-20" },
 					"claude",
 				),
 			);
@@ -436,19 +522,16 @@ export class UsageTracker {
 		}
 	}
 
-	private async fetchCodex(auth: AuthEntries): Promise<UsageSnapshot["codex"] | undefined> {
-		if (!hasCodexAuth(auth)) return undefined;
-		const entry = auth["openai-codex"];
-		const access = entry?.access as string;
-		const accountId = entry?.accountId as string;
+	private async fetchCodex(auth: AuthEntries, accountId: string): Promise<UsageSnapshot["codex"] | undefined> {
+		const entry = auth[accountId];
+		const access = entry?.access;
+		const account = entry?.accountId;
+		if (typeof access !== "string" || typeof account !== "string" || !access || !account) return undefined;
 		try {
 			return parseCodexUsage(
 				await this.fetchJson(
 					CODEX_USAGE_URL,
-					{
-						Authorization: `Bearer ${access}`,
-						"chatgpt-account-id": accountId,
-					},
+					{ Authorization: `Bearer ${access}`, "chatgpt-account-id": account },
 					"codex",
 				),
 			);
@@ -457,3 +540,13 @@ export class UsageTracker {
 		}
 	}
 }
+
+/** The cached values for the currently selected accounts, in display shape. */
+function cachedSnapshot(cache: UsageCache, accounts: UsageAccounts): UsageSnapshot {
+	const snapshot: UsageSnapshot = {};
+	const claude = cache.accounts[accounts.claude]?.claude;
+	const codex = cache.accounts[accounts.codex]?.codex;
+	if (claude) snapshot.claude = claude;
+	if (codex) snapshot.codex = codex;
+	return snapshot;
+}