@hienlh/ppm 0.19.2 → 0.19.3

package/src/services/claude-usage.service.ts

@@ -2,17 +2,19 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import {
-  insertLimitSnapshot,
   getLatestLimitSnapshot,
   getLatestSnapshotForAccount,
   getAllLatestSnapshots,
-  cleanupOldLimitSnapshots,
-  touchSnapshotTimestamp,
   type LimitSnapshotRow,
 } from "./db.service.ts";
 import { accountService } from "./account.service.ts";
 import { decrypt } from "../lib/account-crypto.ts";
 import { accountSelector } from "./account-selector.service.ts";
+import { registerAllUsageSources } from "./provider-usage/register-usage-sources.ts";
+import { startProviderUsagePolling, stopProviderUsagePolling, sweepUsageSource } from "./provider-usage/usage-scheduler.ts";
+import { refreshUsage as refreshProviderUsage } from "./provider-usage/usage-registry.ts";
+import { claudeUsageSource } from "./claude-usage-source.ts";
+import { resetUsageRuntimeState } from "./provider-usage/index.ts";
 
 export interface LimitBucket {
   utilization: number;
@@ -43,20 +45,8 @@ const API_URL = "https://api.anthropic.com/api/oauth/usage";
 const API_BETA = "oauth-2025-04-20";
 const USER_AGENT = "claude-code/1.0";
 const FETCH_TIMEOUT = 10_000;
-const POLL_INTERVAL = 300_000; // 5min
-const ACCOUNT_STAGGER_MS = 1_000; // 1s between accounts
-
 let inMemoryCostUsd = 0;
 
-// Survive Bun --hot reloads: module-level vars reset on reload, globalThis persists.
-// Without this, each hot-reload creates a NEW polling timer without clearing the old one,
-// leading to N concurrent timers after N reloads (observed: 221 timers → 38k 429 errors/day).
-const HOT_KEY = "__PPM_USAGE_POLL__" as const;
-const hotState = ((globalThis as any)[HOT_KEY] ??= {
-  pollTimer: null as ReturnType<typeof setTimeout> | null,
-  inflightPoll: null as Promise<void> | null,
-}) as { pollTimer: ReturnType<typeof setTimeout> | null; inflightPoll: Promise<void> | null };
-
 // Per-token cooldown map: token prefix → earliest allowed fetch time
 const tokenCooldowns = new Map<string, number>();
 const MIN_COOLDOWN_MS = 60_000; // floor: at least 60s cooldown on 429
@@ -141,73 +131,61 @@ async function fetchUsageForToken(token: string): Promise<ClaudeUsage> {
 // Persistence
 // ---------------------------------------------------------------------------
 
-function hasChanged(data: ClaudeUsage, last: LimitSnapshotRow | null): boolean {
-  if (!last) return true;
-  const d = (a: number | null | undefined, b: number | null) =>
-    a != null && (b == null || Math.abs(a - b) > 0.001);
-  if (d(data.session?.utilization, last.five_hour_util)) return true;
-  if (d(data.weekly?.utilization, last.weekly_util)) return true;
-  if (data.session?.resetsAt && data.session.resetsAt !== (last.five_hour_resets_at ?? "")) return true;
-  if (data.weekly?.resetsAt && data.weekly.resetsAt !== (last.weekly_resets_at ?? "")) return true;
-  return false;
-}
-
-function persistIfChanged(data: ClaudeUsage, accountId: string | null): void {
-  const last = accountId ? getLatestSnapshotForAccount(accountId) : getLatestLimitSnapshot();
-  if (!hasChanged(data, last)) {
-    // Data unchanged but still update timestamp so "last fetched" is accurate
-    if (accountId) touchSnapshotTimestamp(accountId);
-    return;
-  }
-  insertLimitSnapshot({
-    account_id: accountId,
-    five_hour_util: data.session?.utilization ?? null,
-    five_hour_resets_at: data.session?.resetsAt ?? null,
-    weekly_util: data.weekly?.utilization ?? null,
-    weekly_resets_at: data.weekly?.resetsAt ?? null,
-    weekly_opus_util: data.weeklyOpus?.utilization ?? null,
-    weekly_opus_resets_at: data.weeklyOpus?.resetsAt ?? null,
-    weekly_sonnet_util: data.weeklySonnet?.utilization ?? null,
-    weekly_sonnet_resets_at: data.weeklySonnet?.resetsAt ?? null,
-  });
-  cleanupOldLimitSnapshots();
-}
-
 // ---------------------------------------------------------------------------
 // Multi-account polling
 // ---------------------------------------------------------------------------
 
-async function fetchAllAccountUsages(): Promise<void> {
-  const accounts = accountService.list();
+/**
+ * Whether a background sweep should pass over this account without calling it.
+ *
+ * Not a failure: an expired login, an API key (no usage endpoint), or a token
+ * still inside its post-429 cooldown all mean "nothing to ask right now", and
+ * the last stored reading stays valid.
+ */
+export async function shouldSkipClaudeAccount(accountId: string): Promise<boolean> {
+  const acc = accountService.list().find((a) => a.id === accountId);
+  if (!acc) return true;
   const nowS = Math.floor(Date.now() / 1000);
-  for (const acc of accounts) {
-    // Disabled accounts still poll usage — disable only removes them from the chat
-    // rotation, it should not stop usage tracking. (GET usage doesn't consume quota.)
-    // Skip expired temporary accounts (no refresh token)
-    if (!accountService.hasRefreshToken(acc.id) && acc.expiresAt && acc.expiresAt < nowS) continue;
-    // Ensure token is fresh before calling usage API (prevents 401 from expired tokens)
-    const withTokens = await accountService.ensureFreshToken(acc.id);
-    if (!withTokens) continue;
-    const token = withTokens.accessToken;
-    // Only OAuth tokens have usage endpoint
-    if (!token.startsWith("sk-ant-oat")) continue;
-    // Check cooldown from previous 429
-    const cooldownKey = token.substring(0, 20);
-    const cooldownUntil = tokenCooldowns.get(cooldownKey);
-    if (cooldownUntil && Date.now() < cooldownUntil) {
-      const secs = Math.ceil((cooldownUntil - Date.now()) / 1000);
-      console.log(`[usage] ${acc.label ?? acc.id}: rate-limited, ${secs}s remaining`);
-      continue;
-    }
-    try {
-      const data = await fetchUsageForToken(token);
-      tokenCooldowns.delete(cooldownKey); // clear cooldown on success
-      persistIfChanged(data, acc.id);
-    } catch (e) {
-      console.error(`[usage] ${acc.label ?? acc.id}:`, (e as Error).message);
-    }
-    if (accounts.length > 1) await new Promise(r => setTimeout(r, ACCOUNT_STAGGER_MS));
+  // Disabled accounts still poll usage — disable only removes them from the chat
+  // rotation, it should not stop usage tracking. (GET usage doesn't consume quota.)
+  // Skip expired temporary accounts (no refresh token).
+  if (!accountService.hasRefreshToken(acc.id) && acc.expiresAt && acc.expiresAt < nowS) return true;
+  const withTokens = await accountService.ensureFreshToken(acc.id);
+  if (!withTokens) return true;
+  // Only OAuth tokens have a usage endpoint.
+  if (!withTokens.accessToken.startsWith("sk-ant-oat")) return true;
+  const cooldownUntil = tokenCooldowns.get(withTokens.accessToken.substring(0, 20));
+  if (cooldownUntil && Date.now() < cooldownUntil) {
+    console.log(`[usage] ${acc.label ?? acc.id}: rate-limited, ${Math.ceil((cooldownUntil - Date.now()) / 1000)}s remaining`);
+    return true;
   }
+  return false;
+}
+
+/**
+ * Read one Claude account's usage live. Throws on failure — the shared layer
+ * needs to tell a failure apart from an account with nothing to report.
+ *
+ * Persisting is deliberately NOT done here: that belongs to the shared layer,
+ * which stores every provider's snapshots through one path.
+ */
+export async function fetchClaudeAccountUsage(accountId: string): Promise<ClaudeUsage> {
+  const withTokens = await accountService.ensureFreshToken(accountId);
+  if (!withTokens) throw new Error(`account ${accountId} has no usable token`);
+  const token = withTokens.accessToken;
+  const data = await fetchUsageForToken(token);
+  tokenCooldowns.delete(token.substring(0, 20)); // cleared on success
+  return data;
+}
+
+/**
+ * Read the ambient Claude login (macOS Keychain or `~/.claude/.credentials.json`),
+ * for installs that never added an account to PPM.
+ */
+export async function fetchLegacyClaudeUsage(): Promise<ClaudeUsage> {
+  const token = getLegacyAccessToken();
+  if (!token) throw new Error("no ambient Claude login");
+  return fetchUsageForToken(token);
 }
 
 // Legacy: Keychain-based single-token fetch (no accounts in DB)
@@ -230,40 +208,6 @@ function getLegacyAccessToken(): string | null {
   return token;
 }
 
-async function fetchLegacySingleAccount(): Promise<void> {
-  const token = getLegacyAccessToken();
-  if (!token) return;
-  try {
-    const data = await fetchUsageForToken(token);
-    persistIfChanged(data, null);
-  } catch {}
-}
-
-async function pollOnceInternal(): Promise<void> {
-  try {
-    const hasAccounts = accountService.list().length > 0;
-    if (hasAccounts) {
-      await fetchAllAccountUsages();
-    } else {
-      await fetchLegacySingleAccount();
-    }
-  } catch (e) {
-    console.error("[usage] pollOnce error:", (e as Error).message);
-  }
-}
-
-/** Deduped: concurrent callers share a single in-flight fetch */
-async function pollOnce(): Promise<void> {
-  if (hotState.inflightPoll) return hotState.inflightPoll;
-  const thisPoll = pollOnceInternal().finally(() => {
-    // Only clear if still the current poll — prevents a stale .finally() from
-    // clearing a newer poll after timeout handler force-nulled inflightPoll.
-    if (hotState.inflightPoll === thisPoll) hotState.inflightPoll = null;
-  });
-  hotState.inflightPoll = thisPoll;
-  return thisPoll;
-}
-
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -323,27 +267,21 @@ export function getCachedUsage(preferredAccountId?: string): ClaudeUsage & { act
   return snapshotToUsage(row);
 }
 
+/**
+ * Start background usage refresh for EVERY provider, not only Claude.
+ *
+ * Kept under its historical name because that is what `server/index.ts` calls,
+ * but the timer, the stagger, the per-fetch timeout, and the persistence now
+ * live in the shared provider-usage layer. Claude reaches them through
+ * `claudeUsageSource` exactly as codex reaches them through its own source.
+ */
 export function startUsagePolling(): void {
-  if (hotState.pollTimer) return;
-  const POLL_TIMEOUT = 60_000; // max 60s per poll iteration
-  const scheduleNext = () => {
-    hotState.pollTimer = setTimeout(async () => {
-      const timeout = new Promise<"timeout">(r => setTimeout(() => r("timeout"), POLL_TIMEOUT));
-      const result = await Promise.race([
-        pollOnce().then(() => "done" as const),
-        timeout,
-      ]).catch(() => "error" as const);
-      // If the poll timed out, force-clear inflightPoll so next scheduled poll
-      // starts a fresh fetch instead of reusing the stale hanging promise.
-      if (result === "timeout") hotState.inflightPoll = null;
-      scheduleNext();
-    }, POLL_INTERVAL);
-  };
-  pollOnce().then(scheduleNext, scheduleNext);
+  registerAllUsageSources();
+  startProviderUsagePolling();
 }
 
 export function stopUsagePolling(): void {
-  if (hotState.pollTimer) { clearTimeout(hotState.pollTimer); hotState.pollTimer = null; }
+  stopProviderUsagePolling();
 }
 
 export function updateFromSdkEvent(_rateLimitType?: string, _utilization?: number, costUsd?: number): void {
@@ -351,35 +289,28 @@ export function updateFromSdkEvent(_rateLimitType?: string, _utilization?: numbe
 }
 
 export async function refreshUsageNow(): Promise<ClaudeUsage & { activeAccountId?: string; activeAccountLabel?: string }> {
-  await pollOnce();
+  // One sweep of Claude's accounts through the shared layer — same code path the
+  // background timer uses, so a manual refresh cannot drift from an automatic one.
+  registerAllUsageSources();
+  await sweepUsageSource(claudeUsageSource);
   return getCachedUsage();
 }
 
 /** Fetch + persist usage for a single account (used right after an account is added). */
 export async function refreshUsageForAccount(accountId: string): Promise<ClaudeUsage> {
-  const withTokens = await accountService.ensureFreshToken(accountId);
-  if (!withTokens) return {};
-  const token = withTokens.accessToken;
-  if (!token.startsWith("sk-ant-oat")) return {};
-  const cooldownKey = token.substring(0, 20);
-  const cooldownUntil = tokenCooldowns.get(cooldownKey);
-  if (cooldownUntil && Date.now() < cooldownUntil) return getUsageForAccount(accountId);
-  try {
-    const data = await fetchUsageForToken(token);
-    tokenCooldowns.delete(cooldownKey);
-    persistIfChanged(data, accountId);
-    return data;
-  } catch (e) {
-    console.error(`[usage] refreshUsageForAccount ${accountId}:`, (e as Error).message);
-    return getUsageForAccount(accountId);
-  }
+  registerAllUsageSources();
+  if (await shouldSkipClaudeAccount(accountId)) return getUsageForAccount(accountId);
+  // The shared layer caches, stores, and swallows the error into the last known
+  // value, so there is nothing left for this wrapper to do but name the account.
+  return refreshProviderUsage("claude", accountId);
 }
 
 /** @internal Test-only: reset module-level state between tests */
 export function _resetForTesting(): void {
   inMemoryCostUsd = 0;
-  if (hotState.pollTimer) { clearTimeout(hotState.pollTimer); hotState.pollTimer = null; }
   tokenCooldowns.clear();
-  hotState.inflightPoll = null;
   tokenCache = null;
+  // The timer, in-flight sweeps, and the usage cache moved to the shared layer,
+  // so the reset has to reach them there or a stuck sweep survives the reset.
+  resetUsageRuntimeState();
 }

package/src/services/codex-account-login.ts

@@ -1,10 +1,17 @@
 /**
- * Codex account login orchestration (P2). Logs codex into a per-account
- * CODEX_HOME via a short-lived app-server, verifies with account/read, then
- * persists the account. Two headless paths (P0-verified):
+ * Codex account login orchestration. Logs codex into a per-account CODEX_HOME
+ * via a short-lived app-server, verifies with account/read, then persists the
+ * account. Two headless paths:
  *   - apiKey: instant (account/login/start stores the key; validated on first use).
- *   - chatgptDeviceCode: returns a user-code + URL; completes via the
- *     account/login/completed notification (long-poll via awaitDeviceLogin).
+ *   - chatgptDeviceCode: returns a user-code + URL; the app-server's
+ *     account/login/completed notification finalizes the account in the
+ *     background and the browser short-polls getDeviceLoginStatus for it.
+ *
+ * Device-code completion deliberately does NOT ride on the HTTP request that
+ * started it. Holding one request open for the whole authorization means any
+ * dropped socket (a proxy or tunnel in front of PPM) destroys the only path the
+ * result had — the login still succeeds server-side but the browser is told it
+ * failed, and a retry cannot recover the flow.
  */
 import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync } from "node:fs";
@@ -16,7 +23,18 @@ const CAPABILITIES = { experimentalApi: true, requestAttestation: false, optOutN
 
 interface AccountRead { account: { type: string; email?: string; planType?: string | null } | null }
 
-async function handshake(c: CodexJsonRpcClient): Promise<void> {
+/** The slice of the app-server client the login flow uses. Narrowing it here lets
+ * a unit test drive the whole flow without spawning a real subprocess. */
+export interface LoginClient {
+  start(opts?: { cwd?: string; codexHome?: string }): void;
+  onNotification(fn: (n: { method: string; params?: unknown }) => void): void;
+  onClose(fn: (code: number | null) => void): void;
+  request<T = unknown>(method: string, params?: unknown): Promise<T>;
+  notify(method: string, params?: unknown): void;
+  close(): void;
+}
+
+async function handshake(c: LoginClient): Promise<void> {
   await c.request("initialize", { clientInfo: CLIENT_INFO, capabilities: CAPABILITIES });
   c.notify("initialized");
 }
@@ -45,76 +63,126 @@ export async function addApiKeyAccount(apiKey: string, label?: string): Promise<
   }
 }
 
-interface PendingLogin {
-  client: CodexJsonRpcClient; home: string; label?: string;
-  completed: Promise<{ success?: boolean; error?: string | null }>;
+// ── ChatGPT device-code login ──
+
+/** Terminal states stay readable for a grace window, so a poll that loses its
+ * response can simply ask again instead of losing the outcome. */
+export type DeviceLoginStatus =
+  | { state: "pending" }
+  | { state: "done"; account: CodexAccount }
+  | { state: "error"; error: string };
+
+interface DeviceLogin {
+  client: LoginClient; home: string; label?: string;
+  status: DeviceLoginStatus;
   timer: ReturnType<typeof setTimeout>;
+  /** True from the completion notification until the account is written. The
+   * home must survive this window even if the browser walks away. */
+  finalizing: boolean;
 }
-const pendingDeviceLogins = new Map<string, PendingLogin>();
-const DEVICE_LOGIN_TTL = 200_000; // self-cleanup window if the client never calls /await
+const deviceLogins = new Map<string, DeviceLogin>();
+
+/** How long an unfinished authorization may sit before it is reaped. */
+const DEVICE_LOGIN_TTL = 200_000;
+/** How long a finished result stays readable for the polling browser. */
+const RESULT_GRACE_MS = 120_000;
 
-/** Drop a pending login: close its subprocess, optionally remove its (half-built) home. */
-function purgePending(id: string, rmHome: boolean): void {
-  const p = pendingDeviceLogins.get(id);
+function unref(t: ReturnType<typeof setTimeout>): ReturnType<typeof setTimeout> {
+  (t as { unref?: () => void }).unref?.();
+  return t;
+}
+
+/** Forget a flow entirely: stop its app-server, optionally drop its home. */
+function disposeDeviceLogin(id: string, rmHome: boolean): void {
+  const p = deviceLogins.get(id);
   if (!p) return;
-  pendingDeviceLogins.delete(id);
+  deviceLogins.delete(id);
   clearTimeout(p.timer);
   try { p.client.close(); } catch { /* ignore */ }
   if (rmHome) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
 }
 
-/** Begin a ChatGPT device-code login. Returns the code/URL the user enters in a browser. */
-export async function startDeviceLogin(label?: string): Promise<{ id: string; userCode: string; verificationUrl: string }> {
+/** Record the outcome and stop the app-server. First settle wins, so the close
+ * event that trails a success cannot overwrite it. The entry lingers for
+ * RESULT_GRACE_MS — that window is what makes a lost poll response harmless. */
+function settle(id: string, status: Exclude<DeviceLoginStatus, { state: "pending" }>): void {
+  const p = deviceLogins.get(id);
+  if (!p || p.status.state !== "pending") return;
+  p.status = status;
+  clearTimeout(p.timer);
+  try { p.client.close(); } catch { /* ignore */ }
+  // A failure leaves no account owning the dir, so the half-built home goes now.
+  // A success must keep it: createCodexAccount adopted it as the account's home.
+  if (status.state === "error") { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
+  p.timer = unref(setTimeout(() => { deviceLogins.delete(id); }, RESULT_GRACE_MS));
+}
+
+/** Turn the app-server's completion notification into a persisted account. */
+async function finalizeDeviceLogin(id: string, notif: { success?: boolean; error?: string | null }): Promise<void> {
+  const p = deviceLogins.get(id);
+  if (!p || p.status.state !== "pending") return;
+  if (!notif?.success) { settle(id, { state: "error", error: notif?.error || "login not completed" }); return; }
+  p.finalizing = true;
+  try {
+    const read = await p.client.request<AccountRead>("account/read", {});
+    if (!read?.account) throw new Error("login completed but account is empty");
+    const account = createCodexAccount({
+      id, label: p.label || read.account.email || "ChatGPT", type: "chatgpt",
+      planType: read.account.planType ?? null,
+    });
+    settle(id, { state: "done", account });
+  } catch (e) {
+    settle(id, { state: "error", error: (e as Error).message });
+  }
+}
+
+/** Begin a ChatGPT device-code login. Returns the code/URL the user enters in a
+ * browser; the caller then polls getDeviceLoginStatus. */
+export async function startDeviceLogin(
+  label?: string,
+  makeClient: () => LoginClient = () => new CodexJsonRpcClient(),
+): Promise<{ id: string; userCode: string; verificationUrl: string }> {
   const id = randomUUID();
   const home = codexAccountHome(id);
   mkdirSync(home, { recursive: true, mode: 0o700 });
-  const client = new CodexJsonRpcClient();
-  let resolveDone!: (v: { success?: boolean; error?: string | null }) => void;
-  const completed = new Promise<{ success?: boolean; error?: string | null }>((r) => { resolveDone = r; });
+  const client = makeClient();
   client.onNotification((n) => {
-    if (n.method === "account/login/completed") resolveDone((n.params ?? {}) as { success?: boolean; error?: string | null });
+    if (n.method === "account/login/completed") {
+      void finalizeDeviceLogin(id, (n.params ?? {}) as { success?: boolean; error?: string | null });
+    }
   });
-  client.onClose(() => resolveDone({ success: false, error: "login process exited" }));
-  // Self-cleanup if the FE abandons the flow (never calls /await): reap the orphan
-  // subprocess + half-built home. Cleared once /await claims the pending entry.
-  const timer = setTimeout(() => purgePending(id, true), DEVICE_LOGIN_TTL);
-  (timer as { unref?: () => void }).unref?.();
+  client.onClose(() => settle(id, { state: "error", error: "login process exited" }));
+  // Never cleared by a poll: an abandoned browser cannot leak the subprocess or
+  // the half-built home the way a request-scoped timer could.
+  const timer = unref(setTimeout(() => settle(id, { state: "error", error: "timed out" }), DEVICE_LOGIN_TTL));
+  // Registered before the first I/O so a notification (or an immediate exit)
+  // arriving mid-handshake still finds its entry.
+  deviceLogins.set(id, { client, home, label, status: { state: "pending" }, timer, finalizing: false });
   try {
     client.start({ codexHome: home });
     await handshake(client);
-    const start = await client.request<{ userCode?: string; verificationUrl?: string }>("account/login/start", { type: "chatgptDeviceCode" });
-    pendingDeviceLogins.set(id, { client, home, label, completed, timer });
+    const start = await client.request<{ userCode?: string; verificationUrl?: string }>(
+      "account/login/start", { type: "chatgptDeviceCode" },
+    );
     return { id, userCode: start?.userCode ?? "", verificationUrl: start?.verificationUrl ?? "" };
   } catch (e) {
-    clearTimeout(timer);
-    try { client.close(); } catch { /* ignore */ }
-    try { rmSync(home, { recursive: true, force: true }); } catch { /* ignore */ }
+    disposeDeviceLogin(id, true);
     throw e;
   }
 }
 
-/** Long-poll until the device login completes (or times out). Persists on success. */
-export async function awaitDeviceLogin(id: string, timeoutMs = 180_000): Promise<CodexAccount> {
-  const p = pendingDeviceLogins.get(id);
-  if (!p) throw new Error("no pending device login for that id");
-  // Claim-once: remove from the map + cancel self-cleanup so a double-await or the
-  // timer can't race this call.
-  pendingDeviceLogins.delete(id);
-  clearTimeout(p.timer);
-  const timeout = new Promise<{ success?: boolean; error?: string | null }>((r) => setTimeout(() => r({ success: false, error: "timed out" }), timeoutMs));
-  try {
-    const res = await Promise.race([p.completed, timeout]);
-    if (!res?.success) throw new Error(res?.error || "login not completed");
-    const read = await p.client.request<AccountRead>("account/read", {});
-    if (!read?.account) throw new Error("login completed but account is empty");
-    // Success: keep the home (it now holds auth.json) — createCodexAccount reuses it.
-    return createCodexAccount({
-      id, label: p.label || read.account.email || "ChatGPT", type: "chatgpt", planType: read.account.planType ?? null,
-    });
-  } catch (e) {
-    try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ }
-    throw e;
-  } finally {
-    try { p.client.close(); } catch { /* ignore */ }
-  }
+/** Read a device-code flow's outcome. Idempotent — repeat polls are free and a
+ * dropped response costs one tick, not the flow. */
+export function getDeviceLoginStatus(id: string): DeviceLoginStatus {
+  return deviceLogins.get(id)?.status ?? { state: "error", error: "no pending device login for that id" };
+}
+
+/** Abandon a flow the user cancelled. A login already being written is left
+ * alone — tearing it down here would delete the home mid-write and lose an
+ * authorization the user completed. A finished one keeps its home: an account
+ * owns it now. */
+export function cancelDeviceLogin(id: string): void {
+  const p = deviceLogins.get(id);
+  if (!p || p.finalizing) return;
+  disposeDeviceLogin(id, p.status.state !== "done");
 }

package/src/services/codex-account.service.ts

@@ -14,7 +14,7 @@ import { getDb, getSessionCodexAccount } from "./db.service.ts";
 import { getPpmDir } from "./ppm-dir.ts";
 import { configService } from "./config.service.ts";
 import { encrypt, decrypt } from "../lib/account-crypto.ts";
-import { fetchCodexUsage } from "../providers/codex-app-server/codex-usage-fetch.ts";
+import { getOrFetchUsage } from "./provider-usage/usage-registry.ts";
 import type { UsageInfo } from "../providers/provider.interface.ts";
 
 export type CodexStrategy = "round-robin" | "fill-first" | "lowest-usage";
@@ -145,6 +145,27 @@ export function selectCodexAccount(opts?: { strategy?: CodexStrategy; usageOf?:
   return pick;
 }
 
+/**
+ * The account that WILL serve a session with no binding yet, when that is
+ * knowable without side effects — otherwise null.
+ *
+ * Exists so the chat toolbar can name the account before the first message
+ * instead of showing a blank where the account belongs. It deliberately does
+ * not call `selectCodexAccount`: round-robin advances a cursor, so asking it
+ * merely to draw a label would change which account the next real turn gets.
+ *
+ * Certain in exactly two cases — a single account, and `fill-first`, which
+ * always takes the oldest. Round-robin and lowest-usage across several
+ * accounts are genuinely undecided until the turn starts, and this returns
+ * null rather than guessing at one.
+ */
+export function peekCodexAccount(): CodexAccount | null {
+  const accts = listCodexAccounts();
+  if (accts.length === 0) return null;
+  if (accts.length === 1) return accts[0]!;
+  return getCodexStrategy() === "fill-first" ? accts[0]! : null;
+}
+
 /** Sticky account for a session → else strategy pick → else null (default ~/.codex). */
 export async function resolveCodexAccountForSession(sessionId: string): Promise<CodexAccount | null> {
   const sticky = getSessionCodexAccount(sessionId);
@@ -159,13 +180,15 @@ export async function resolveCodexAccountForSession(sessionId: string): Promise<
 }
 
 // ── Usage (per account) ──
+// Both read through the shared provider-usage layer, so the accounts screen is
+// served from the same cache and snapshot store as the chat toolbar and cannot
+// spawn one app-server per listed account on every render.
 export async function getCodexAccountUsage(id: string): Promise<UsageInfo> {
-  const a = getCodexAccount(id);
-  return a ? fetchCodexUsage(a.home) : {};
+  return getCodexAccount(id) ? getOrFetchUsage("codex", id) : {};
 }
 
 export async function getAllCodexUsages(): Promise<Record<string, UsageInfo>> {
   const accts = listCodexAccounts();
-  const entries = await Promise.all(accts.map(async (a) => [a.id, await fetchCodexUsage(a.home)] as const));
+  const entries = await Promise.all(accts.map(async (a) => [a.id, await getOrFetchUsage("codex", a.id)] as const));
   return Object.fromEntries(entries);
 }