@hank-warren/pi-statusline 0.4.2 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @hank-warren/pi-statusline
 
+## 0.6.0
+
+### Minor Changes
+
+- 01994c7: Show the Codex 5-hour window alongside the weekly one. Codex has restored a 5-hour limit next to the weekly one on some plans, and the parser already received that window and deliberately discarded it — it kept only the largest window spanning at least a day — so a real limit went unshown. Both are now rendered like the Claude meter: 5-hour, dim separator, weekly.
+
+  Which windows exist is a property of the account, so the two slots are filled from each window's span rather than from the plan name: the shortest sub-day window fills the 5-hour slot and the longest multi-day window fills the other. A plan with no 5-hour limit keeps rendering its single weekly number, and a free plan's lone 30-day window keeps rendering in the same place. A payload carrying only a sub-day window now reports it as the 5-hour value instead of mislabelling it as weekly.
+
+  The host-wide usage cache changes additively: an entry written by an earlier version has no 5-hour value and renders weekly-only until the next poll, and an earlier version ignores the extra one.
+
+## 0.5.0
+
+### Minor Changes
+
+- 0e9400e: Point each subscription usage meter at the account behind the main model, so additional provider logins report the headroom actually being spent. Families the main model does not belong to keep showing their base account, and a login used only for background work is never polled.
+
+  The host-wide usage cache is now keyed by credential id rather than by provider family. Keyed by family, two sessions on two different Anthropic accounts each looked like an account switch to the other, evicting each other's values and re-polling every cycle. Cache files written by earlier versions are discarded, costing one extra poll on upgrade.
+
 ## 0.4.2
 
 ### Patch Changes

package/README.md

@@ -71,13 +71,27 @@ Up to 0.2.x this package hardcoded five alias pairs and stripped a `platform-` p
 When Pi's `~/.pi/agent/auth.json` contains OAuth credentials for Anthropic (Claude subscription) and/or OpenAI Codex, line 1 shows **percent remaining** for each rate-limit window after the context meter:
 
 - ` 97·54` — Claude 5-hour, then weekly remaining percent (Nerd Font `nf-cod-claude` icon). Subscriptions with a model-scoped weekly limit (e.g. Fable) show it as a third number — ` 97·54·24` — and it is omitted when the account has none.
-- ` 80` — Codex weekly remaining percent (`nf-cod-openai` icon)
+- ` 92·99` — Codex 5-hour, then weekly remaining percent (`nf-cod-openai` icon). Which windows exist is a property of the plan, so the slots are filled from the payload's window spans rather than from its plan name: a plan with no 5-hour limit shows the weekly number alone — ` 45` — and a free plan, whose single window is monthly, shows that one number in the same place.
 
 Numbers are colored by remaining headroom: green above 60, yellow 41–60, orange 16–40, red at 15 and below.
 
 Usage is fetched from the providers' own usage endpoints with Pi's stored tokens — read-only; tokens are never refreshed or written. Fetches happen on session start and after each turn, throttled to at most once every five minutes (the Anthropic usage endpoint rate-limits aggressively), and are strictly best-effort: on any failure the last-known value is kept, and providers without credentials (or before the first successful fetch) are simply omitted, leaving the statusline exactly as before. While a provider that *does* have credentials still has no value, the throttle drops to 30 seconds — Pi only refreshes an expired OAuth access token when that provider is first used, so a session starting with a stale Anthropic token would otherwise show no Claude meter for a full interval.
 
-Polling is host-wide, not per-session. Usage percentages describe the account rather than the session, and a busy machine runs dozens of pi processes, so every process shares `~/.pi/agent/statusline-usage.json`: it holds the last good snapshot plus the time the last poll was *started*, written atomically via a temp file and rename. A session adopts the cached values on its first refresh — so the meters are populated before it has issued a single request — and only polls when that shared timestamp is older than the interval. A provider answering `429` is parked for fifteen minutes (tracked per provider, so a rate-limited Anthropic never stops codex from updating) and stops counting as pending, since retrying harder is what earns the rate limit in the first place. Each provider's cache entry is keyed to a fingerprint (a sha256 prefix, never the token itself) of the credentials that fetched it: switching accounts — or rotating a token — discards that provider's cached numbers and backoff and polls immediately, so an exhausted old account's meters never masquerade as the new account's. Requires a Nerd Font new enough to include the codicon brand glyphs (v3.5.0+); older fonts render them as replacement boxes.
+### Which account each meter shows
+
+With a single login per provider — the ordinary case, including logging out and back in as a different Anthropic account — nothing here applies: each meter shows that provider's account, exactly as before.
+
+When [`@hank-warren/pi-multi-login`](../pi-multi-login/README.md) has registered additional logins (`anthropic-work`, `openai-codex-alt`), a provider family can hold several accounts at once. Each meter then shows **the account behind the main model**, falling back to the base account (`anthropic`, `openai-codex`) when the main model belongs to the other family. So switching the main model between two Claude logins swaps the Claude meter and leaves the Codex meter alone, and a login used only for background work — such as a `pi-auto-permissions` reviewer, which is never the main model — is never polled at all. There is deliberately no marker for *which* account is shown: the meter tracks whatever you are actually spending.
+
+### Polling and the shared cache
+
+Polling is host-wide, not per-session. Usage percentages describe the account rather than the session, and a busy machine runs dozens of pi processes, so every process shares `~/.pi/agent/statusline-usage.json`, written atomically via a temp file and rename. It is keyed by **credential id**, one entry per account, each holding that account's last good values plus the time its last poll was *started*. A session adopts the cached values for its selected accounts on first refresh — so the meters are populated before it has issued a single request, and switching back to an account polled earlier repaints with no request at all — and only polls an account whose timestamp is older than the interval. Keying by account rather than by provider family is what lets two sessions on two different Anthropic logins coexist: keyed by family, each looked like an account switch to the other, so they evicted each other's values and re-polled every cycle.
+
+Cache entries stay compatible in both directions: a Codex entry written by a statusline older than 0.6.0 carries no 5-hour value, so a newer one renders it as a single weekly number until its own next poll fills the second slot, and an older reader ignores the extra value entirely.
+
+An account answering `429` is parked for fifteen minutes (tracked per account, so a rate-limited Anthropic never stops codex from updating) and stops counting as pending, since retrying harder is what earns the rate limit in the first place. Every cache entry is keyed to a fingerprint (a sha256 prefix, never the token itself) of the credential that fetched it: switching accounts — or rotating a token — discards that entry's numbers and backoff and polls immediately, so an exhausted old account's meters never masquerade as the new account's. A logged-out account fails the same check, so the file garbage-collects itself.
+
+Requires a Nerd Font new enough to include the codicon brand glyphs (v3.5.0+); older fonts render them as replacement boxes.
 
 ## Cache-hit celebration
 

package/index.ts

@@ -71,15 +71,21 @@ export function renderUsageSegment(
 	palette: StatuslinePalette = DEFAULT_PALETTE,
 ): string | undefined {
 	const percent = (remaining: number) => styled(bandColor(remaining, palette), `${remaining}`);
+	const dot = styled(palette.dim, "\u00b7");
 	const parts: string[] = [];
 	if (usage.claude) {
-		const dot = styled(palette.dim, "\u00b7");
 		let claude = `${percent(usage.claude.fiveHour)}${dot}${percent(usage.claude.sevenDay)}`;
 		if (usage.claude.scopedWeekly !== undefined) claude += `${dot}${percent(usage.claude.scopedWeekly)}`;
 		parts.push(`${styled(palette.text, CLAUDE_ICON)} ${claude}`);
 	}
 	if (usage.codex) {
-		parts.push(`${styled(palette.text, OPENAI_ICON)} ${percent(usage.codex.weekly)}`);
+		// Shortest window first, mirroring Claude. Plans without a 5-hour limit
+		// leave that slot empty and keep rendering the single long-window number.
+		const codex = [usage.codex.fiveHour, usage.codex.weekly]
+			.filter((remaining): remaining is number => remaining !== undefined)
+			.map(percent)
+			.join(dot);
+		if (codex.length > 0) parts.push(`${styled(palette.text, OPENAI_ICON)} ${codex}`);
 	}
 	return parts.length > 0 ? parts.join(" ") : undefined;
 }
@@ -264,7 +270,10 @@ export default function statuslineExtension(pi: ExtensionAPI): void {
 		cwdStatusAbort = new AbortController();
 		cwdStatusInFlight = undefined;
 		runInBackground(refreshCwdStatus(ctx));
-		if (settings.showUsage) runInBackground(usageTracker.refresh());
+		if (settings.showUsage) {
+			usageTracker.setActiveProvider(ctx.model?.provider);
+			runInBackground(usageTracker.refresh());
+		}
 		// A hidden worktree line must not pay for git/gh polling.
 		if (!settings.showWorktrees) return;
 		const next = new SessionWorktreeTracker({
@@ -446,9 +455,20 @@ export default function statuslineExtension(pi: ExtensionAPI): void {
 		requestRender?.();
 		runInBackground(refreshCwdStatus(ctx));
 		if (tracker) runInBackground(tracker.refresh());
-		if (settings.showUsage) runInBackground(usageTracker.refresh());
+		if (settings.showUsage) {
+			usageTracker.setActiveProvider(ctx.model?.provider);
+			runInBackground(usageTracker.refresh());
+		}
+	});
+	// The meters follow the main model's account, so a switch between two logins
+	// of the same provider family has to re-point the tracker before it repaints.
+	pi.on("model_select", (event) => {
+		if (settings.showUsage) {
+			usageTracker.setActiveProvider(event.model.provider);
+			runInBackground(usageTracker.refresh());
+		}
+		requestRender?.();
 	});
-	pi.on("model_select", () => requestRender?.());
 	pi.on("session_tree", (_event, ctx) => resetTracker(ctx));
 	pi.on("session_shutdown", () => {
 		cacheCelebration.dispose();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-statusline",
-  "version": "0.4.2",
+  "version": "0.6.0",
   "description": "Compact Pi footer statusline with Git/worktree context, token usage, and neon celebrations for exceptional prompt-cache hits.",
   "type": "module",
   "keywords": [

package/usage.ts

@@ -7,7 +7,12 @@ import { pid } from "node:process";
 /** Remaining (not used) integer percents per provider window. */
 export interface UsageSnapshot {
 	claude?: { fiveHour: number; sevenDay: number; scopedWeekly?: number };
-	codex?: { weekly: number };
+	/**
+	 * Codex reports one or two windows depending on the plan: a short (5-hour)
+	 * window, a long one, or both. Every field is optional because which of them
+	 * exists is a property of the account, not of the payload shape.
+	 */
+	codex?: { fiveHour?: number; weekly?: number };
 }
 
 const CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
@@ -25,7 +30,7 @@ export const USAGE_REFRESH_INTERVAL_MS = 5 * 60_000;
  */
 export const USAGE_RETRY_INTERVAL_MS = 30_000;
 /**
- * How long a provider is left alone after it answers 429. Polls are host-wide
+ * How long an account is left alone after it answers 429. Polls are host-wide
  * (see the shared cache below), so a rate limit means the provider itself wants
  * a break rather than that we are racing ourselves.
  */
@@ -79,7 +84,19 @@ interface CodexWindow {
 	limit_window_seconds?: unknown;
 }
 
-/** Parse the Codex usage payload, selecting the weekly (largest ≥ 1 day) window. */
+/** A window whose span is known, so it can be sorted into a slot. */
+interface SpannedCodexWindow extends CodexWindow {
+	limit_window_seconds: number;
+}
+
+/**
+ * Parse the Codex usage payload into the short (sub-day) and long (≥ 1 day)
+ * windows. Which ones exist depends on the plan — $20 plans report a 5-hour
+ * window alongside the weekly one, larger plans have reported weekly only, and
+ * free plans report a single 30-day window that lands in the long slot. So the
+ * slots are filled from `limit_window_seconds` rather than from `plan_type`,
+ * and an absent window simply leaves its slot empty.
+ */
 export function parseCodexUsage(json: unknown): UsageSnapshot["codex"] | undefined {
 	if (typeof json !== "object" || json === null) return undefined;
 	const rateLimit = (json as { rate_limit?: unknown }).rate_limit;
@@ -88,14 +105,27 @@ export function parseCodexUsage(json: unknown): UsageSnapshot["codex"] | undefin
 		primary_window?: CodexWindow | null;
 		secondary_window?: CodexWindow | null;
 	};
+	// A window without a usable span cannot be placed in either slot.
 	const windows = [primary_window, secondary_window].filter(
-		(window): window is CodexWindow => typeof window === "object" && window !== null,
+		(window): window is SpannedCodexWindow =>
+			typeof window === "object" &&
+			window !== null &&
+			typeof window.limit_window_seconds === "number" &&
+			Number.isFinite(window.limit_window_seconds),
 	);
-	const weekly = windows
-		.filter((window) => typeof window.limit_window_seconds === "number" && window.limit_window_seconds >= ONE_DAY_SECONDS)
-		.sort((a, b) => (b.limit_window_seconds as number) - (a.limit_window_seconds as number))[0];
-	const remaining = toRemaining((weekly ?? windows[0])?.used_percent);
-	return remaining === undefined ? undefined : { weekly: remaining };
+	const shortest = windows
+		.filter((window) => window.limit_window_seconds < ONE_DAY_SECONDS)
+		.sort((a, b) => a.limit_window_seconds - b.limit_window_seconds)[0];
+	const longest = windows
+		.filter((window) => window.limit_window_seconds >= ONE_DAY_SECONDS)
+		.sort((a, b) => b.limit_window_seconds - a.limit_window_seconds)[0];
+	const fiveHour = toRemaining(shortest?.used_percent);
+	const weekly = toRemaining(longest?.used_percent);
+	if (fiveHour === undefined && weekly === undefined) return undefined;
+	const result: UsageSnapshot["codex"] = {};
+	if (fiveHour !== undefined) result.fiveHour = fiveHour;
+	if (weekly !== undefined) result.weekly = weekly;
+	return result;
 }
 
 /** Color band for a remaining percent: >60 green, >40 yellow, >15 orange, else red. */
@@ -118,124 +148,167 @@ export interface UsageTrackerOptions {
 	fetchFn?: FetchFn;
 	onChange?: () => void;
 	now?: () => number;
+	/** Provider id of the session's main model; selects which account is polled. */
+	activeProvider?: string;
 }
 
 type ProviderKey = "claude" | "codex";
 
 const PROVIDER_KEYS = ["claude", "codex"] as const;
 
-/** Non-reversible per-provider credential fingerprints; never raw tokens. */
+/** Provider ids whose additional logins (`${base}-${suffix}`) share a meter. */
+export const USAGE_BASE_PROVIDERS: Record<ProviderKey, string> = {
+	claude: "anthropic",
+	codex: "openai-codex",
+};
+
+/** Credential id polled for each family. */
+export type UsageAccounts = Record<ProviderKey, string>;
+
+function inFamily(providerId: string | undefined, base: string): boolean {
+	return providerId === base || (providerId !== undefined && providerId.startsWith(`${base}-`));
+}
+
+/** The family an account id belongs to, or undefined when it is neither. */
+function familyOf(accountId: string): ProviderKey | undefined {
+	return PROVIDER_KEYS.find((key) => inFamily(accountId, USAGE_BASE_PROVIDERS[key]));
+}
+
+/**
+ * Choose the account whose meter each family shows.
+ *
+ * Additional logins (@hank-warren/pi-multi-login) mean a family can hold several
+ * accounts at once. The one worth showing is the one the session is actually
+ * spending: the provider of the main model. Every other family falls back to its
+ * base account, which is what makes a backup provider's meter stay visible while
+ * you are not using it — and what keeps a dedicated background-reviewer login
+ * (never the main model) from ever being polled.
+ */
+export function resolveUsageAccounts(activeProvider: string | undefined): UsageAccounts {
+	const accounts = { ...USAGE_BASE_PROVIDERS };
+	for (const key of PROVIDER_KEYS) {
+		if (inFamily(activeProvider, USAGE_BASE_PROVIDERS[key])) accounts[key] = activeProvider as string;
+	}
+	return accounts;
+}
+
+/** Non-reversible per-family credential fingerprints; never raw tokens. */
 type ProviderIdentities = Partial<Record<ProviderKey, string>>;
 
 function fingerprint(material: string): string {
 	return createHash("sha256").update(material).digest("hex").slice(0, 16);
 }
 
+interface AuthEntry {
+	access?: unknown;
+	accountId?: unknown;
+}
+
+type AuthEntries = Record<string, AuthEntry | undefined>;
+
 /**
- * Fingerprint the credentials each provider would be polled with. Usage
- * percentages belong to an account, so a cached value is only trustworthy
- * while the credentials that produced it are still the ones in auth.json —
- * after an account switch, yesterday's "1% left" is somebody else's meter.
+ * Fingerprint the credential an account would be polled with, or undefined when
+ * it cannot be polled at all. Usage percentages belong to an account, so a
+ * cached value is only trustworthy while the credential that produced it is
+ * still the one in auth.json — after an account switch, yesterday's "1% left"
+ * is somebody else's meter.
  */
-function credentialIdentities(auth: AuthEntries): ProviderIdentities {
+function accountFingerprint(auth: AuthEntries, accountId: string): string | undefined {
+	const entry = auth[accountId];
+	const access = entry?.access;
+	if (typeof access !== "string" || access.length === 0) return undefined;
+	if (familyOf(accountId) === "codex") {
+		const account = entry?.accountId;
+		if (typeof account !== "string" || account.length === 0) return undefined;
+		return fingerprint(`${access}\n${account}`);
+	}
+	return fingerprint(access);
+}
+
+function hasAuth(auth: AuthEntries, accountId: string): boolean {
+	return accountFingerprint(auth, accountId) !== undefined;
+}
+
+function credentialIdentities(auth: AuthEntries, accounts: UsageAccounts): ProviderIdentities {
 	const identities: ProviderIdentities = {};
-	if (hasClaudeAuth(auth)) identities.claude = fingerprint(String(auth.anthropic?.access));
-	if (hasCodexAuth(auth)) {
-		const entry = auth["openai-codex"];
-		identities.codex = fingerprint(`${entry?.access as string}\n${entry?.accountId as string}`);
+	for (const key of PROVIDER_KEYS) {
+		const value = accountFingerprint(auth, accounts[key]);
+		if (value !== undefined) identities[key] = value;
 	}
 	return identities;
 }
 
+/** One account's shared poll state. Only the family's own field is ever set. */
+interface UsageAccountEntry {
+	/** Credential fingerprint the stored values were fetched with. */
+	identity: string;
+	/** Last time any process started a poll for this account. */
+	attemptedAt: number;
+	/** Absolute time before which a rate-limited account must not be polled. */
+	backoff?: number;
+	claude?: UsageSnapshot["claude"];
+	codex?: UsageSnapshot["codex"];
+}
+
 /**
  * Host-wide poll state shared by every pi process. Usage percentages are a
- * property of the account, not of a session, so one poll per interval per host
- * is both sufficient and necessary: a busy host runs dozens of pi processes, and
- * per-process polling stampedes the endpoints into rate limiting everyone.
+ * property of the account, not of a session, so one poll per interval per
+ * account is both sufficient and necessary: a busy host runs dozens of pi
+ * processes, and per-process polling stampedes the endpoints into rate limiting
+ * everyone.
+ *
+ * Keyed by credential id rather than by family, because two sessions on the
+ * same host may legitimately be using two different Anthropic accounts. Keying
+ * by family made each of them look like an account switch to the other, so they
+ * evicted each other's values and re-polled on every cycle — the exact
+ * stampede this cache exists to prevent.
  */
 interface UsageCache {
-	/** Last time any process started a poll; gates the shared throttle. */
-	attemptedAt: number;
-	/** Absolute times before which a rate-limited provider must not be polled. */
-	backoff: Partial<Record<ProviderKey, number>>;
-	snapshot: UsageSnapshot;
-	/** Credential fingerprints the snapshot was fetched with. */
-	identity: ProviderIdentities;
+	accounts: Record<string, UsageAccountEntry>;
 }
 
-const EMPTY_CACHE: UsageCache = {
-	attemptedAt: Number.NEGATIVE_INFINITY,
-	backoff: {},
-	snapshot: {},
-	identity: {},
-};
+const EMPTY_CACHE: UsageCache = { accounts: {} };
 
 /**
- * Drop cached values that were fetched with different credentials. A token
- * rotation looks the same as an account switch here; the cost of treating it
- * as one is a single immediate re-poll, while trusting a stale identity means
- * showing another account's numbers as if they were current.
+ * Drop entries whose credential no longer matches auth.json. A token rotation
+ * looks the same as an account switch here; the cost of treating it as one is a
+ * single immediate re-poll, while trusting a stale identity means showing
+ * another account's numbers as if they were current. Logged-out accounts fail
+ * the same check, so the file garbage-collects itself.
  */
-function pruneCache(cache: UsageCache, identity: ProviderIdentities): UsageCache {
-	const snapshot = { ...cache.snapshot };
-	const backoff = { ...cache.backoff };
+function pruneCache(cache: UsageCache, auth: AuthEntries): UsageCache {
+	const accounts: Record<string, UsageAccountEntry> = {};
 	let changed = false;
-	for (const key of PROVIDER_KEYS) {
-		if (cache.identity[key] === identity[key]) continue;
-		if (snapshot[key] !== undefined || backoff[key] !== undefined) changed = true;
-		delete snapshot[key];
-		delete backoff[key];
+	for (const [accountId, entry] of Object.entries(cache.accounts)) {
+		if (accountFingerprint(auth, accountId) === entry.identity) accounts[accountId] = entry;
+		else changed = true;
 	}
-	if (!changed) return cache;
-	// The pruned values also claimed the shared throttle slot; the new account's
-	// first poll must not wait out a window started for somebody else.
-	return { attemptedAt: Number.NEGATIVE_INFINITY, backoff, snapshot, identity };
+	return changed ? { accounts } : cache;
 }
 
 function parseUsageCache(json: unknown): UsageCache | undefined {
 	if (typeof json !== "object" || json === null) return undefined;
-	const body = json as { attemptedAt?: unknown; backoff?: unknown; snapshot?: unknown; identity?: unknown };
-	if (typeof body.attemptedAt !== "number" || !Number.isFinite(body.attemptedAt)) return undefined;
-	const snapshot = typeof body.snapshot === "object" && body.snapshot !== null ? (body.snapshot as UsageSnapshot) : {};
-	const backoff: UsageCache["backoff"] = {};
-	const identity: ProviderIdentities = {};
-	for (const key of PROVIDER_KEYS) {
-		if (typeof body.backoff === "object" && body.backoff !== null) {
-			const value = (body.backoff as Record<string, unknown>)[key];
-			if (typeof value === "number" && Number.isFinite(value)) backoff[key] = value;
-		}
-		if (typeof body.identity === "object" && body.identity !== null) {
-			const value = (body.identity as Record<string, unknown>)[key];
-			if (typeof value === "string") identity[key] = value;
-		}
+	const rawAccounts = (json as { accounts?: unknown }).accounts;
+	if (typeof rawAccounts !== "object" || rawAccounts === null) return undefined;
+	const accounts: Record<string, UsageAccountEntry> = {};
+	for (const [accountId, value] of Object.entries(rawAccounts as Record<string, unknown>)) {
+		if (typeof value !== "object" || value === null) continue;
+		const body = value as Record<string, unknown>;
+		if (typeof body.identity !== "string") continue;
+		if (typeof body.attemptedAt !== "number" || !Number.isFinite(body.attemptedAt)) continue;
+		const entry: UsageAccountEntry = { identity: body.identity, attemptedAt: body.attemptedAt };
+		if (typeof body.backoff === "number" && Number.isFinite(body.backoff)) entry.backoff = body.backoff;
+		if (typeof body.claude === "object" && body.claude !== null) entry.claude = body.claude as UsageSnapshot["claude"];
+		if (typeof body.codex === "object" && body.codex !== null) entry.codex = body.codex as UsageSnapshot["codex"];
+		accounts[accountId] = entry;
 	}
-	return { attemptedAt: body.attemptedAt, backoff, snapshot, identity };
-}
-
-interface AuthEntries {
-	anthropic?: { access?: unknown };
-	"openai-codex"?: { access?: unknown; accountId?: unknown };
-}
-
-function hasClaudeAuth(auth: AuthEntries): boolean {
-	const access = auth.anthropic?.access;
-	return typeof access === "string" && access.length > 0;
-}
-
-function hasCodexAuth(auth: AuthEntries): boolean {
-	const entry = auth["openai-codex"];
-	return (
-		typeof entry?.access === "string" &&
-		entry.access.length > 0 &&
-		typeof entry.accountId === "string" &&
-		entry.accountId.length > 0
-	);
+	return { accounts };
 }
 
 /**
  * Best-effort subscription usage poller. Reads Pi's auth.json for tokens (never
  * refreshes them), fetches both usage endpoints, and keeps the last-known good
- * value per provider. Refreshes are throttled and must never throw.
+ * value per account. Refreshes are throttled and must never throw.
  */
 export class UsageTracker {
 	private readonly authPath: string;
@@ -245,9 +318,10 @@ export class UsageTracker {
 	private readonly now: () => number;
 	private current: UsageSnapshot = {};
 	private identities: ProviderIdentities = {};
+	private activeProvider: string | undefined;
 	private awaitingProvider = true;
 	private readonly rateLimited = new Set<ProviderKey>();
-	private lastAttempt = Number.NEGATIVE_INFINITY;
+	private lastAttempt: Record<string, number> = {};
 	private inFlight: Promise<void> | undefined;
 
 	constructor(options: UsageTrackerOptions = {}) {
@@ -256,12 +330,22 @@ export class UsageTracker {
 		this.fetchFn = options.fetchFn ?? ((url, init) => fetch(url, init));
 		this.onChange = options.onChange;
 		this.now = options.now ?? Date.now;
+		this.activeProvider = options.activeProvider;
 	}
 
 	snapshot(): UsageSnapshot {
 		return this.current;
 	}
 
+	/**
+	 * Point the meters at the session's main model. A switch between two accounts
+	 * in the same family changes which one is displayed; the next refresh adopts
+	 * the new account's cached value if there is one, and polls otherwise.
+	 */
+	setActiveProvider(providerId: string | undefined): void {
+		this.activeProvider = providerId;
+	}
+
 	/**
 	 * Interval until the next allowed attempt: the short retry window while a
 	 * credentialed provider is still missing a value, the full interval otherwise.
@@ -285,58 +369,89 @@ export class UsageTracker {
 	}
 
 	/**
-	 * One refresh cycle: adopt whatever another process has already published,
-	 * then poll only if the shared throttle allows it.
+	 * One refresh cycle: adopt whatever another process has already published for
+	 * the selected accounts, then poll only those the shared throttle allows.
 	 */
 	private async performRefresh(): Promise<void> {
 		const auth = (await this.readAuth()) ?? {};
-		const identity = credentialIdentities(auth);
-		const cache = pruneCache((await this.readCache()) ?? EMPTY_CACHE, identity);
-		this.pruneCurrent(identity);
+		const accounts = resolveUsageAccounts(this.activeProvider);
+		const identity = credentialIdentities(auth, accounts);
+		const cache = pruneCache((await this.readCache()) ?? EMPTY_CACHE, auth);
+		this.pruneCurrent(identity, accounts);
 		// Another process's values are as good as ours and cost no request, so a new
-		// session shows real numbers on its very first render.
-		this.publish(this.merge(cache.snapshot, auth), auth, cache);
+		// session — or a switch back to an account polled earlier — shows real
+		// numbers on its very first render.
+		this.publish(this.merge(cachedSnapshot(cache, accounts), auth, accounts), auth, accounts, cache);
 
 		const now = this.now();
-		const lastAttempt = Math.max(this.lastAttempt, cache.attemptedAt);
-		if (now - lastAttempt < this.currentInterval()) return;
-		const claudeAllowed = hasClaudeAuth(auth) && now >= (cache.backoff.claude ?? Number.NEGATIVE_INFINITY);
-		const codexAllowed = hasCodexAuth(auth) && now >= (cache.backoff.codex ?? Number.NEGATIVE_INFINITY);
-		if (!claudeAllowed && !codexAllowed) return;
-
-		this.lastAttempt = now;
-		// Claim the slot before fetching so sibling processes skip this window even
+		const interval = this.currentInterval();
+		const pollable: Partial<Record<ProviderKey, string>> = {};
+		for (const key of PROVIDER_KEYS) {
+			const accountId = accounts[key];
+			if (!hasAuth(auth, accountId)) continue;
+			const entry = cache.accounts[accountId];
+			if (now < (entry?.backoff ?? Number.NEGATIVE_INFINITY)) continue;
+			const lastAttempt = Math.max(
+				this.lastAttempt[accountId] ?? Number.NEGATIVE_INFINITY,
+				entry?.attemptedAt ?? Number.NEGATIVE_INFINITY,
+			);
+			if (now - lastAttempt < interval) continue;
+			pollable[key] = accountId;
+		}
+		if (pollable.claude === undefined && pollable.codex === undefined) return;
+
+		// Claim each slot before fetching so sibling processes skip this window even
 		// if our own request is slow or fails outright. The claim carries the fresh
 		// identity so siblings do not re-prune and stampede the same window.
-		await this.writeCache({ ...cache, attemptedAt: now, identity });
+		const claimed = { ...cache.accounts };
+		for (const key of PROVIDER_KEYS) {
+			const accountId = pollable[key];
+			if (accountId === undefined) continue;
+			this.lastAttempt[accountId] = now;
+			claimed[accountId] = {
+				...claimed[accountId],
+				identity: identity[key] as string,
+				attemptedAt: now,
+			};
+		}
+		await this.writeCache({ accounts: claimed });
 
 		const [claude, codex] = await Promise.all([
-			claudeAllowed ? this.fetchClaude(auth) : Promise.resolve(undefined),
-			codexAllowed ? this.fetchCodex(auth) : Promise.resolve(undefined),
+			pollable.claude === undefined ? Promise.resolve(undefined) : this.fetchClaude(auth, pollable.claude),
+			pollable.codex === undefined ? Promise.resolve(undefined) : this.fetchCodex(auth, pollable.codex),
 		]);
-		const backoff = { ...cache.backoff };
-		for (const key of ["claude", "codex"] as const) {
-			if (this.rateLimited.has(key)) backoff[key] = now + USAGE_RATE_LIMIT_BACKOFF_MS;
-			else if ((key === "claude" ? claude : codex) !== undefined) delete backoff[key];
+
+		const updatedAccounts = { ...claimed };
+		for (const key of PROVIDER_KEYS) {
+			const accountId = pollable[key];
+			if (accountId === undefined) continue;
+			const entry: UsageAccountEntry = { ...(updatedAccounts[accountId] as UsageAccountEntry) };
+			const value = key === "claude" ? claude : codex;
+			if (this.rateLimited.has(key)) entry.backoff = now + USAGE_RATE_LIMIT_BACKOFF_MS;
+			else if (value !== undefined) delete entry.backoff;
+			// A failed fetch leaves the last-known value in place rather than blanking
+			// the meter for whatever caused one bad response.
+			if (claude !== undefined && key === "claude") entry.claude = claude;
+			if (codex !== undefined && key === "codex") entry.codex = codex;
+			updatedAccounts[accountId] = entry;
 		}
 		this.rateLimited.clear();
 
-		const next = this.merge({ claude, codex }, auth);
-		const updated: UsageCache = { attemptedAt: now, backoff, snapshot: next, identity };
-		this.publish(next, auth, updated);
+		const updated: UsageCache = { accounts: updatedAccounts };
+		this.publish(this.merge({ claude, codex }, auth, accounts), auth, accounts, updated);
 		await this.writeCache(updated);
 	}
 
 	/**
 	 * Drop in-memory values fetched with previous credentials so merge() cannot
 	 * resurrect another account's numbers, and let the changed identity reopen
-	 * this process's own throttle gate.
+	 * this process's own throttle gate for the newly selected account.
 	 */
-	private pruneCurrent(identity: ProviderIdentities): void {
+	private pruneCurrent(identity: ProviderIdentities, accounts: UsageAccounts): void {
 		const changedKeys = PROVIDER_KEYS.filter((key) => this.identities[key] !== identity[key]);
 		this.identities = identity;
 		if (changedKeys.length === 0) return;
-		this.lastAttempt = Number.NEGATIVE_INFINITY;
+		for (const key of changedKeys) delete this.lastAttempt[accounts[key]];
 		if (!changedKeys.some((key) => this.current[key] !== undefined)) return;
 		const next = { ...this.current };
 		for (const key of changedKeys) delete next[key];
@@ -346,17 +461,17 @@ export class UsageTracker {
 	}
 
 	/**
-	 * Layer fresh values over the last-known ones and drop providers without
-	 * credentials: a logged-out provider must disappear immediately, while a
-	 * failed fetch keeps whatever we last saw.
+	 * Layer fresh values over the last-known ones and drop families whose selected
+	 * account has no credentials: a logged-out account must disappear immediately,
+	 * while a failed fetch keeps whatever we last saw.
 	 */
-	private merge(incoming: UsageSnapshot, auth: AuthEntries): UsageSnapshot {
+	private merge(incoming: UsageSnapshot, auth: AuthEntries, accounts: UsageAccounts): UsageSnapshot {
 		const next: UsageSnapshot = {};
-		if (hasClaudeAuth(auth)) {
+		if (hasAuth(auth, accounts.claude)) {
 			const claude = incoming.claude ?? this.current.claude;
 			if (claude) next.claude = claude;
 		}
-		if (hasCodexAuth(auth)) {
+		if (hasAuth(auth, accounts.codex)) {
 			const codex = incoming.codex ?? this.current.codex;
 			if (codex) next.codex = codex;
 		}
@@ -364,13 +479,16 @@ export class UsageTracker {
 	}
 
 	/** Adopt a snapshot, recompute the retry gate, and repaint only on a change. */
-	private publish(next: UsageSnapshot, auth: AuthEntries, cache: UsageCache): void {
+	private publish(next: UsageSnapshot, auth: AuthEntries, accounts: UsageAccounts, cache: UsageCache): void {
 		const now = this.now();
-		// A provider serving 429s is not "pending": retrying it faster is exactly
+		// An account serving 429s is not "pending": retrying it faster is exactly
 		// what got us rate limited, so it must not hold the short window open.
-		this.awaitingProvider =
-			(hasClaudeAuth(auth) && next.claude === undefined && now >= (cache.backoff.claude ?? 0)) ||
-			(hasCodexAuth(auth) && next.codex === undefined && now >= (cache.backoff.codex ?? 0));
+		this.awaitingProvider = PROVIDER_KEYS.some(
+			(key) =>
+				hasAuth(auth, accounts[key]) &&
+				next[key] === undefined &&
+				now >= (cache.accounts[accounts[key]]?.backoff ?? 0),
+		);
 		if (JSON.stringify(next) === JSON.stringify(this.current)) return;
 		this.current = next;
 		this.onChange?.();
@@ -418,16 +536,14 @@ export class UsageTracker {
 		}
 	}
 
-	private async fetchClaude(auth: AuthEntries): Promise<UsageSnapshot["claude"] | undefined> {
-		if (!hasClaudeAuth(auth)) return undefined;
+	private async fetchClaude(auth: AuthEntries, accountId: string): Promise<UsageSnapshot["claude"] | undefined> {
+		const access = auth[accountId]?.access;
+		if (typeof access !== "string" || access.length === 0) return undefined;
 		try {
 			return parseClaudeUsage(
 				await this.fetchJson(
 					CLAUDE_USAGE_URL,
-					{
-						Authorization: `Bearer ${auth.anthropic?.access as string}`,
-						"anthropic-beta": "oauth-2025-04-20",
-					},
+					{ Authorization: `Bearer ${access}`, "anthropic-beta": "oauth-2025-04-20" },
 					"claude",
 				),
 			);
@@ -436,19 +552,16 @@ export class UsageTracker {
 		}
 	}
 
-	private async fetchCodex(auth: AuthEntries): Promise<UsageSnapshot["codex"] | undefined> {
-		if (!hasCodexAuth(auth)) return undefined;
-		const entry = auth["openai-codex"];
-		const access = entry?.access as string;
-		const accountId = entry?.accountId as string;
+	private async fetchCodex(auth: AuthEntries, accountId: string): Promise<UsageSnapshot["codex"] | undefined> {
+		const entry = auth[accountId];
+		const access = entry?.access;
+		const account = entry?.accountId;
+		if (typeof access !== "string" || typeof account !== "string" || !access || !account) return undefined;
 		try {
 			return parseCodexUsage(
 				await this.fetchJson(
 					CODEX_USAGE_URL,
-					{
-						Authorization: `Bearer ${access}`,
-						"chatgpt-account-id": accountId,
-					},
+					{ Authorization: `Bearer ${access}`, "chatgpt-account-id": account },
 					"codex",
 				),
 			);
@@ -457,3 +570,13 @@ export class UsageTracker {
 		}
 	}
 }
+
+/** The cached values for the currently selected accounts, in display shape. */
+function cachedSnapshot(cache: UsageCache, accounts: UsageAccounts): UsageSnapshot {
+	const snapshot: UsageSnapshot = {};
+	const claude = cache.accounts[accounts.claude]?.claude;
+	const codex = cache.accounts[accounts.codex]?.codex;
+	if (claude) snapshot.claude = claude;
+	if (codex) snapshot.codex = codex;
+	return snapshot;
+}