@hienlh/ppm 0.20.8 → 0.20.9

package/src/providers/codex-app-server/codex-provider.ts

@@ -19,9 +19,11 @@ import {
   peekCodexAccount,
   selectCodexAccount,
   getAllCodexUsages,
+  getCodexAccountUsage,
   codexUsageLevel,
   type CodexAccount,
 } from "../../services/codex-account.service.ts";
+import { dailyGuardMessage, dailyGuardState } from "../../shared/codex-daily-guard.ts";
 import { isCodexAccountUsageLimited, markCodexAccountUsageLimited } from "../../services/codex-account-cooldown.ts";
 import { isCodexUsageLimit, codexErrorMessage, parseCodexUsageLimitReset } from "./codex-usage-limit.ts";
 import { killProcessTree } from "../../services/windows-process-tree.ts";
@@ -157,6 +159,8 @@ interface LiveSession {
    *  nothing downstream can notice. Follow-ups therefore wait in `pendingTurns`
    *  and are sent when the running turn reports `turn/completed`. */
   turnInFlight?: boolean;
+  /** A daily-guard usage read is in progress before the next turn starts. */
+  checkingDailyGuard?: boolean;
   /** Id of the running turn — `turn/interrupt` needs it, `threadId` alone is rejected. */
   activeTurnId?: string | null;
   /** Interrupt asked for before `turn/started` named the turn; fired on arrival. */
@@ -397,7 +401,7 @@ export class CodexAppServerProvider implements AIProvider {
         return;
       }
     }
-    this.startTurn(live, message, opts);
+    void this.startTurn(live, message, opts);
     for await (const ev of live.channel.iterator) {
       yield ev;
     }
@@ -407,7 +411,23 @@ export class CodexAppServerProvider implements AIProvider {
   pushMessage(sessionId: string, content: string, opts?: SendMessageOpts): void {
     const live = this.live.get(sessionId);
     if (!live || live.client.isClosed) return;
-    this.startTurn(live, content, opts);
+    void this.startTurn(live, content, opts);
+  }
+
+  /** Return a refusal only when this session's managed account opted into pacing. */
+  private async dailyGuardError(live: LiveSession): Promise<string | null> {
+    const accountId = live.threadId ? getSessionCodexAccount(live.threadId) : null;
+    const account = accountId ? getCodexAccount(accountId) : null;
+    if (!account?.dailyGuardEnabled) return null;
+    try {
+      const usage = await getCodexAccountUsage(account.id);
+      const state = usage.session == null ? dailyGuardState(usage.weekly) : null;
+      return state?.blocked ? dailyGuardMessage(state) : null;
+    } catch {
+      // An unreadable quota cannot honestly be called spent. Keep the account usable and let
+      // Codex's real quota refusal remain the authority until the next successful usage read.
+      return null;
+    }
   }
 
   /**
@@ -418,7 +438,7 @@ export class CodexAppServerProvider implements AIProvider {
    * second entry would both show it twice and shift every later `rollout-N` id, which
    * fork anchors resolve against.
    */
-  private startTurn(live: LiveSession, message: string, opts?: SendMessageOpts, replay = false): void {
+  private async startTurn(live: LiveSession, message: string, opts?: SendMessageOpts, replay = false): Promise<void> {
     if (!live.threadId) return;
     // One turn at a time — anything sent now would be dropped without a trace.
     // `now` additionally cuts the running turn short so this one answers next.
@@ -428,6 +448,19 @@ export class CodexAppServerProvider implements AIProvider {
       if (priority === "now") this.interruptActiveTurn(live);
       return;
     }
+    if (live.checkingDailyGuard) {
+      this.enqueueTurn(live, { message, opts, priority: opts?.priority ?? "next" });
+      return;
+    }
+    live.checkingDailyGuard = true;
+    const guardError = await this.dailyGuardError(live);
+    live.checkingDailyGuard = false;
+    if (guardError) {
+      live.channel.push({ type: "error", message: guardError });
+      live.channel.push({ type: "done", sessionId: live.threadId, resultSubtype: "error_during_execution" });
+      this.endTurn(live);
+      return;
+    }
     live.turnInFlight = true;
     // `/compact` → trigger codex's real compaction (thread/compact/start), not a text turn.
     // Completion is surfaced on the `thread/compacted` notification (handleNotification).
@@ -516,7 +549,7 @@ export class CodexAppServerProvider implements AIProvider {
     live.interruptRequested = false;
     live.lastTurnInput = undefined;
     const next = live.pendingTurns.shift();
-    if (next) this.startTurn(live, next.message, next.opts);
+    if (next) void this.startTurn(live, next.message, next.opts);
   }
 
   // ── Usage-limit rotation ──
@@ -593,7 +626,7 @@ export class CodexAppServerProvider implements AIProvider {
     live.turnInFlight = false;
     live.activeTurnId = null;
     live.interruptRequested = false;
-    if (pending) this.startTurn(live, pending.message, pending.opts, true);
+    if (pending) void this.startTurn(live, pending.message, pending.opts, true);
     else this.endTurn(live);
   }
 

package/src/providers/codex-app-server/codex-usage-parser.ts

@@ -1,5 +1,6 @@
 import type { UsageInfo, LimitBucket } from "../provider.interface.ts";
 import type { GetAccountRateLimitsResponse, RateLimitWindow } from "./codex-protocol.ts";
+import { codexPlanLabel } from "../../shared/codex-plan-label.ts";
 
 /** codex resetsAt is a unix timestamp; tolerate seconds or milliseconds. */
 function toIso(resetsAt: number | null | undefined): string | undefined {
@@ -64,6 +65,7 @@ export function parseCodexUsage(res: GetAccountRateLimitsResponse | null | undef
       out.session = toBucket(w);
     }
   });
-  if (snap.planType) out.activeAccountLabel = String(snap.planType);
+  const planLabel = codexPlanLabel(snap.planType);
+  if (planLabel) out.activeAccountLabel = planLabel;
   return out;
 }

package/src/server/routes/codex-accounts.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import { ok, err } from "../../types/api.ts";
-import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, codexUsageLevel, type CodexStrategy } from "../../services/codex-account.service.ts";
+import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, setCodexDailyGuard, codexUsageLevel, type CodexStrategy } from "../../services/codex-account.service.ts";
 import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin, startBrowserLogin, submitBrowserCallback, getBrowserLoginStatus, cancelBrowserLogin } from "../../services/codex-account-login.ts";
 import { exportCodexEncrypted, importCodexEncrypted } from "../../services/codex-account-portability.ts";
 
@@ -43,11 +43,15 @@ codexAccountsRoutes.post("/pick", async (c) => {
  * immediately instead of taking the better part of a minute.
  */
 codexAccountsRoutes.patch("/:id", async (c) => {
-  const body = await c.req.json<{ status?: string }>().catch(() => ({} as { status?: string }));
-  if (body.status !== "active" && body.status !== "disabled") {
-    return c.json(err("status must be active or disabled"), 400);
+  const body = await c.req.json<{ status?: string; dailyGuardEnabled?: unknown }>().catch(() => ({} as { status?: string; dailyGuardEnabled?: unknown }));
+  if (body.status !== undefined) {
+    if (body.status !== "active" && body.status !== "disabled") return c.json(err("status must be active or disabled"), 400);
+    const updated = setCodexAccountStatus(c.req.param("id"), body.status);
+    if (!updated) return c.json(err("Account not found"), 404);
+    return c.json(ok(updated));
   }
-  const updated = setCodexAccountStatus(c.req.param("id"), body.status);
+  if (typeof body.dailyGuardEnabled !== "boolean") return c.json(err("status or dailyGuardEnabled is required"), 400);
+  const updated = setCodexDailyGuard(c.req.param("id"), body.dailyGuardEnabled);
   if (!updated) return c.json(err("Account not found"), 404);
   return c.json(ok(updated));
 });

package/src/services/codex-account-login.ts

@@ -15,7 +15,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync } from "node:fs";
-import { buildCodexCallback, checkCodexLoginPort, parseBrowserLogin, type BrowserLoginCallback } from "./codex-login-callback.ts";
+import { buildCodexCallback, buildCodexSuccessCallback, checkCodexLoginPort, parseBrowserLogin, type BrowserLoginCallback } from "./codex-login-callback.ts";
 import { CodexJsonRpcClient, CONTROL_REQUEST_TIMEOUT_MS } from "../providers/codex-app-server/codex-jsonrpc-client.ts";
 import { codexAccountHome, createCodexAccount, type CodexAccount } from "./codex-account.service.ts";
 
@@ -218,18 +218,46 @@ export function submitBrowserCallback(id: string, callbackUrl: string, send: typ
   browser.submitted = true;
   const controller = new AbortController();
   p.callbackAbort = controller;
-  const timeout = unref(setTimeout(() => controller.abort(), 30_000));
+  let timedOut = false;
+  const timeout = unref(setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+    // Bun can leave a loopback fetch pending after its AbortSignal fires. Do not leave the
+    // browser polling forever: the callback code cannot safely be reused, so make the
+    // failure visible and let the user start a fresh authorization.
+    if (isCurrentPendingLogin(id, p)) {
+      settle(id, { state: "error", error: "Codex did not finish the callback within 30 seconds. Start a new browser login and try again." });
+    }
+  }, 30_000));
   void (async () => {
     try {
-      const response = await send(target, { redirect: "manual", signal: controller.signal });
-      // Do not render or log the OAuth response body or follow its redirect.
+      // Connect to 127.0.0.1 (never a user-controlled localhost resolution), but preserve
+      // the OAuth redirect's localhost Host header. Codex's loopback listener associates
+      // the callback with the redirect URI and otherwise accepts the socket without
+      // completing the login.
+      let response = await send(target, {
+        redirect: "manual",
+        signal: controller.signal,
+        headers: { Host: "localhost:1455" },
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        await response.body?.cancel();
+        if (!location) throw new Error("Codex returned a callback redirect without a destination.");
+        response = await send(buildCodexSuccessCallback(location, browser), {
+          redirect: "manual",
+          signal: controller.signal,
+          headers: { Host: "localhost:1455" },
+        });
+      }
+      // Do not render or log either loopback OAuth response body.
       await response.body?.cancel();
       if (response.status >= 400 && isCurrentPendingLogin(id, p)) {
         settle(id, { state: "error", error: "Codex rejected the callback. Start a new browser login." });
       }
     } catch {
       // A closed callback socket may mean successful login. Polling owns the result.
-      if (isCurrentPendingLogin(id, p)) browser.submitted = false;
+      if (!timedOut && isCurrentPendingLogin(id, p)) browser.submitted = false;
     } finally {
       clearTimeout(timeout);
       if (p.callbackAbort === controller) p.callbackAbort = undefined;

package/src/services/codex-account-portability.ts

@@ -20,6 +20,7 @@ interface PortableCodexAccount {
   label: string;
   type: CodexAccountType;
   planType?: string | null;
+  dailyGuardEnabled?: boolean;
   authJson?: string | null; // contents of CODEX_HOME/auth.json
   creds?: CodexCreds | null; // apiKey creds (chatgpt auth lives in authJson)
 }
@@ -35,7 +36,7 @@ export function exportCodexEncrypted(password: string, accountIds?: string[]): s
       const authPath = join(a.home, "auth.json");
       if (existsSync(authPath)) authJson = readFileSync(authPath, "utf8");
     } catch { /* ignore unreadable home */ }
-    return { id: a.id, label: a.label, type: a.type, planType: a.planType ?? null, authJson, creds: getCodexAccountCreds(a.id) };
+    return { id: a.id, label: a.label, type: a.type, planType: a.planType ?? null, dailyGuardEnabled: a.dailyGuardEnabled, authJson, creds: getCodexAccountCreds(a.id) };
   });
   return encryptWithPassword(JSON.stringify({ magic: BACKUP_MAGIC, accounts: portable }), password);
 }
@@ -56,7 +57,7 @@ export function importCodexEncrypted(blob: string, password: string): { imported
     // createCodexAccount inserts the row and mkdirs the CODEX_HOME (0700).
     createCodexAccount({
       id: p.id, label: p.label || "Imported", type: p.type,
-      planType: p.planType ?? null, creds: p.creds ?? undefined,
+      planType: p.planType ?? null, creds: p.creds ?? undefined, dailyGuardEnabled: p.dailyGuardEnabled !== false,
     });
 
     // Restore auth.json so codex re-auths from it on next spawn.

package/src/services/codex-account.service.ts

@@ -16,6 +16,7 @@ import { configService } from "./config.service.ts";
 import { encrypt, decrypt } from "../lib/account-crypto.ts";
 import { getOrFetchUsage } from "./provider-usage/usage-registry.ts";
 import { isCodexAccountUsageLimited } from "./codex-account-cooldown.ts";
+import { dailyGuardMessage, dailyGuardState } from "../shared/codex-daily-guard.ts";
 import type { UsageInfo } from "../providers/provider.interface.ts";
 
 export type CodexStrategy = "round-robin" | "fill-first" | "lowest-usage";
@@ -32,6 +33,7 @@ export interface CodexAccount {
   home: string;
   planType?: string | null;
   status: CodexAccountStatus;
+  dailyGuardEnabled: boolean;
   addedAt: string;
 }
 
@@ -44,6 +46,7 @@ interface Row {
   id: string; label: string | null; type: string; home: string;
   plan_type: string | null; creds_enc: string | null; added_at: string;
   status?: string | null;
+  daily_guard_enabled?: number | null;
 }
 
 function rowToAccount(r: Row): CodexAccount {
@@ -56,6 +59,7 @@ function rowToAccount(r: Row): CodexAccount {
     // A row written before the column existed reads as null; treat that as enabled, which
     // is what it effectively was.
     status: r.status === "disabled" ? "disabled" : "active",
+  dailyGuardEnabled: r.daily_guard_enabled !== 0,
     addedAt: r.added_at,
   };
 }
@@ -87,7 +91,7 @@ export function getCodexAccountCreds(id: string): CodexCreds | null {
  * verified label/planType and the creds to persist (encrypted). Idempotent dir create.
  */
 export function createCodexAccount(input: {
-  label: string; type: CodexAccountType; planType?: string | null; creds?: CodexCreds; id?: string;
+  label: string; type: CodexAccountType; planType?: string | null; creds?: CodexCreds; id?: string; dailyGuardEnabled?: boolean;
 }): CodexAccount {
   const id = input.id ?? randomUUID();
   const home = codexAccountHome(id);
@@ -98,8 +102,8 @@ export function createCodexAccount(input: {
   const credsEnc = input.creds ? encrypt(JSON.stringify(input.creds)) : null;
   try {
     getDb().query(
-      "INSERT INTO codex_accounts (id, label, type, home, plan_type, creds_enc) VALUES (?, ?, ?, ?, ?, ?)",
-    ).run(id, input.label, input.type, home, input.planType ?? null, credsEnc);
+      "INSERT INTO codex_accounts (id, label, type, home, plan_type, creds_enc, daily_guard_enabled) VALUES (?, ?, ?, ?, ?, ?, ?)",
+    ).run(id, input.label, input.type, home, input.planType ?? null, credsEnc, input.dailyGuardEnabled === false ? 0 : 1);
   } catch (e) {
     // Keep the invariant row⟺home: drop the dir if the row didn't land.
     try { rmSync(home, { recursive: true, force: true }); } catch { /* ignore */ }
@@ -136,6 +140,15 @@ export function setCodexAccountStatus(id: string, status: CodexAccountStatus): C
   return getCodexAccount(id);
 }
 
+/** Enable or disable the seven-day quota pacing guard for one account. */
+export function setCodexDailyGuard(id: string, enabled: boolean): CodexAccount | null {
+  if (!getCodexAccount(id)) return null;
+  getDb().query("UPDATE codex_accounts SET daily_guard_enabled = ? WHERE id = ?").run(enabled ? 1 : 0, id);
+  return getCodexAccount(id);
+}
+
+export class CodexDailyGuardError extends Error {}
+
 /** Remove the account row and its CODEX_HOME dir. */
 export function removeCodexAccount(id: string): void {
   const acct = getCodexAccount(id);
@@ -279,15 +292,43 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
   // would do nothing for exactly the conversations already using it. An account parked for
   // an exhausted quota lets go for a different reason — it would refuse the turn, and
   // spending one to rediscover that is worse than starting on an account that can answer.
-  if (sticky) {
-    const a = getCodexAccount(sticky);
-    if (a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id)) return a;
-  }
   // Usage is only worth fetching when it can change the answer, and with at most one
   // account able to serve it cannot. Parked accounts count as unable for the same reason
   // they are skipped below, so a pool of two where one is out of quota resolves without a
   // network read at all.
   const usable = listCodexAccounts().filter((a) => a.status !== "disabled" && !isCodexAccountUsageLimited(a.id));
+  const guarded = usable.filter((a) => a.dailyGuardEnabled);
+  if (guarded.length > 0) {
+    const usages = await getAllCodexUsages();
+    const blocked = guarded.flatMap((a) => {
+      // Pacing is for plans that only expose the weekly bucket. A Plus account's separate
+      // five-hour window is already the useful short-term control and must not gain this row.
+      const usage = usages[a.id];
+      const state = usage?.session == null ? dailyGuardState(usage?.weekly) : null;
+      return state?.blocked ? [a.id] : [];
+    });
+    if (blocked.length > 0) {
+      const stickyAccount = sticky ? getCodexAccount(sticky) : null;
+      if (stickyAccount && !blocked.includes(stickyAccount.id)
+          && stickyAccount.status !== "disabled" && !isCodexAccountUsageLimited(stickyAccount.id)) return stickyAccount;
+      if (blocked.length === usable.length && sessionId) {
+        const account = getCodexAccount(blocked[0]!);
+        const usage = account ? usages[account.id] : undefined;
+        const state = usage?.session == null ? dailyGuardState(usage?.weekly) : null;
+        throw new CodexDailyGuardError(state ? dailyGuardMessage(state) : "Daily guard reached for every available Codex account.");
+      }
+      return selectCodexAccount({ usageOf: (id) => codexUsageLevel(usages[id]), exclude: blocked });
+    }
+    if (sticky) {
+      const a = getCodexAccount(sticky);
+      if (a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id)) return a;
+    }
+    return selectCodexAccount({ usageOf: (id) => codexUsageLevel(usages[id]) });
+  }
+  if (sticky) {
+    const a = getCodexAccount(sticky);
+    if (a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id)) return a;
+  }
   if (usable.length <= 1) return selectCodexAccount();
   // Usage is read for every strategy, not just lowest-usage: it is also what lets the
   // selector skip an account with no five-hour room left. Reading it only for lowest-usage

package/src/services/codex-login-callback.ts

@@ -55,3 +55,21 @@ export function buildCodexCallback(callbackUrl: string, login: BrowserLoginCallb
   expected.searchParams.set("state", state!);
   return expected;
 }
+
+/**
+ * Codex accepts the authorization callback, then redirects to its own loopback
+ * success endpoint with the exchanged id token. Follow exactly that endpoint
+ * while keeping the TCP connection on 127.0.0.1.
+ */
+export function buildCodexSuccessCallback(location: string, login: BrowserLoginCallback): URL {
+  let redirect: URL;
+  try { redirect = new URL(location); } catch { throw new Error("Codex returned an invalid callback redirect."); }
+  const expected = new URL(login.redirectUri);
+  if (redirect.protocol !== "http:" || redirect.hostname !== "localhost" || redirect.port !== expected.port
+    || redirect.pathname !== "/success" || redirect.username || redirect.password || redirect.hash
+    || redirect.searchParams.getAll("id_token").length !== 1) {
+    throw new Error("Codex returned an unsupported callback redirect.");
+  }
+  redirect.hostname = "127.0.0.1";
+  return redirect;
+}

package/src/services/db.service.ts

@@ -1121,6 +1121,20 @@ export function runMigrations(database: Database): void {
     try { database.exec(`ALTER TABLE codex_accounts ADD COLUMN status TEXT NOT NULL DEFAULT 'active'`); } catch { /* exists */ }
     database.exec(`PRAGMA user_version = 47;`);
   }
+
+  if (current < 48) {
+    // Optional per-account pacing for weekly-only Codex plans. Disabled by default so an
+    // upgrade never changes how an existing account is selected or used.
+    try { database.exec(`ALTER TABLE codex_accounts ADD COLUMN daily_guard_enabled INTEGER NOT NULL DEFAULT 0`); } catch { /* exists */ }
+    database.exec(`PRAGMA user_version = 48;`);
+  }
+
+  if (current < 49) {
+    // Daily guard was introduced as an opt-in during development. Ship it enabled so every
+    // weekly-only account starts paced; Plus accounts simply do not surface or use it.
+    database.exec(`UPDATE codex_accounts SET daily_guard_enabled = 1`);
+    database.exec(`PRAGMA user_version = 49;`);
+  }
 }
 
 // ---------------------------------------------------------------------------

package/src/shared/codex-daily-guard.ts

@@ -0,0 +1,27 @@
+import type { LimitBucket } from "../types/chat.ts";
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_DAYS = 7;
+
+export interface DailyGuardState {
+  day: number;
+  cap: number;
+  used: number;
+  blocked: boolean;
+}
+
+/** Split a weekly quota into seven daily envelopes. */
+export function dailyGuardState(bucket: LimitBucket | undefined, now = Date.now()): DailyGuardState | null {
+  if (!bucket || bucket.windowHours !== 168) return null;
+  const resetsAt = new Date(bucket.resetsAt).getTime();
+  if (!Number.isFinite(resetsAt) || resetsAt <= now) return null;
+
+  const startedAt = resetsAt - WEEK_DAYS * DAY_MS;
+  const day = Math.min(WEEK_DAYS, Math.max(1, Math.ceil((now - startedAt) / DAY_MS)));
+  const cap = day / WEEK_DAYS;
+  return { day, cap, used: bucket.utilization, blocked: bucket.utilization >= cap };
+}
+
+export function dailyGuardMessage(state: DailyGuardState): string {
+  return `Daily guard reached: ${Math.round(state.used * 100)}% used; day ${state.day}/7 allows ${Math.round(state.cap * 100)}%. Turn off Daily guard on this account to continue.`;
+}

package/src/shared/codex-plan-label.ts

@@ -0,0 +1,17 @@
+/** Convert Codex's internal subscription enum to the plan name PPM shows people. */
+export function codexPlanLabel(planType: string | null | undefined): string | null {
+  if (!planType?.trim()) return null;
+  const key = planType.trim().toLowerCase();
+  const known: Record<string, string> = {
+    free: "ChatGPT Free",
+    go: "ChatGPT Go",
+    plus: "ChatGPT Plus",
+    pro: "ChatGPT Pro",
+    team: "ChatGPT Team",
+    business: "ChatGPT Business",
+    self_serve_business_prolite: "ChatGPT Business",
+    enterprise: "ChatGPT Enterprise",
+    edu: "ChatGPT Edu",
+  };
+  return known[key] ?? planType;
+}

package/src/web/components/chat/codex-usage-panel.tsx

@@ -21,9 +21,11 @@ import { AccountBucketRow } from "@/components/settings/accounts/account-bucket-
 import { formatResetTime } from "@/components/settings/accounts/account-usage-format";
 import type { AccountUsageEntry } from "@/lib/api-settings";
 import type { UsageInfo } from "../../../types/chat";
+import { codexPlanLabel } from "../../../shared/codex-plan-label.ts";
+import { dailyGuardState } from "../../../shared/codex-daily-guard.ts";
 import { UsagePanelShell } from "./usage-panel-shell";
 
-interface CodexAccount { id: string; label: string; type: string; planType?: string | null; status?: "active" | "disabled" }
+interface CodexAccount { id: string; label: string; type: string; planType?: string | null; status?: "active" | "disabled"; dailyGuardEnabled?: boolean }
 type Usage = Pick<UsageInfo, "fiveHour" | "sevenDay" | "session" | "weekly">;
 
 /** Matches the whole-percent figure the bars show, so a refusal agrees with the card. */
@@ -137,6 +139,20 @@ export function CodexUsagePanel({ onClose, usage, onReload, onSelectAccount, sel
     }
   }, []);
 
+  const handleDailyGuardToggle = useCallback(async (id: string, enabled: boolean) => {
+    setTogglingId(id);
+    setPanelError(null);
+    try {
+      await api.patch(`/api/codex-accounts/${id}`, { dailyGuardEnabled: !enabled });
+      const d = await api.get<{ accounts: CodexAccount[] }>("/api/codex-accounts");
+      setAccounts(d.accounts);
+    } catch (e) {
+      setPanelError((e as Error).message || "Could not change Daily guard");
+    } finally {
+      setTogglingId(null);
+    }
+  }, []);
+
   /* No managed accounts → chats run on the ambient ~/.codex login, whose usage arrives on
      the session prop rather than from the accounts endpoint. */
   const ambient = loading && accounts.length === 0 ? (
@@ -171,6 +187,7 @@ export function CodexUsagePanel({ onClose, usage, onReload, onSelectAccount, sel
     >
       {(layout) => accounts.map((a) => {
         const u = usages[a.id] ?? {};
+        const guard = u.session == null ? dailyGuardState(u.weekly) : null;
         return (
           <AccountCard
             key={a.id}
@@ -179,12 +196,15 @@ export function CodexUsagePanel({ onClose, usage, onReload, onSelectAccount, sel
             // those differ the moment a session is bound to an account.
             isActive={a.id === (selectedAccountId ?? usage.activeAccountId)}
             layout={layout}
-            planLabel={a.planType}
+            planLabel={codexPlanLabel(a.planType)}
             onSelect={onSelectAccount ? handleSelect : undefined}
             unselectableReason={unselectableReason(a, u)}
             selecting={selectingId === a.id}
             onToggle={handleToggle}
             toggling={togglingId === a.id}
+            dailyGuard={guard ? { enabled: !!a.dailyGuardEnabled, state: guard } : undefined}
+            onDailyGuardToggle={guard ? () => void handleDailyGuardToggle(a.id, !!a.dailyGuardEnabled) : undefined}
+            dailyGuardToggling={togglingId === a.id}
           />
         );
       })}

package/src/web/components/settings/accounts/account-card.tsx

@@ -18,7 +18,7 @@
  * while every turn on them failed. The sign-in deadline replaced it.
  */
 
-import { Download, Eye, KeyRound, RefreshCw, Trash2 } from "lucide-react";
+import { CircleHelp, Download, Eye, KeyRound, RefreshCw, Trash2 } from "lucide-react";
 import { Switch } from "@/components/ui/switch";
 import type { AccountInfo, AccountUsageEntry, OAuthProfileData } from "../../../lib/api-settings";
 import { AccountBucketRow } from "./account-bucket-row";
@@ -26,6 +26,7 @@ import { AccountHint } from "./account-hint";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
 import { AccountCardShell } from "./accounts-pane-header";
 import { formatExpiry, formatLastUpdated, tokenStatus } from "./account-usage-format";
+import type { DailyGuardState } from "../../../../shared/codex-daily-guard.ts";
 
 export interface AccountCardProps {
   entry: AccountUsageEntry;
@@ -55,6 +56,10 @@ export interface AccountCardProps {
    *  a plan ("plus", "team") and that decides which quota windows the account even has, so
    *  it belongs on the card; Claude reports none and the badge simply does not appear. */
   planLabel?: string | null;
+  /** Optional pacing control for Codex accounts that expose only a weekly quota. */
+  dailyGuard?: { enabled: boolean; state: DailyGuardState };
+  onDailyGuardToggle?: () => void;
+  dailyGuardToggling?: boolean;
 }
 
 // Fixed widths so a row scrolls instead of squeezing. Two of them: a read-only card holds a
@@ -64,7 +69,7 @@ const STRIP_WIDTH = { readOnly: "min-w-[220px]", withActions: "min-w-[300px]" }
 
 export function AccountCard({
   entry, isActive, accountInfo, onToggle, toggling, onDelete, onExport, onViewProfile, flash,
-  onSelect, unselectableReason, selecting, planLabel,
+  onSelect, unselectableReason, selecting, planLabel, dailyGuard, onDailyGuardToggle, dailyGuardToggling,
   layout = "list",
 }: AccountCardProps) {
   const { usage } = entry;
@@ -259,6 +264,42 @@ export function AccountCard({
         </p>
       )}
 
+      {dailyGuard && (
+        <div className={`flex min-h-12 items-center justify-between gap-3 rounded-md border px-2.5 py-1.5 ${
+          dailyGuard.enabled && dailyGuard.state.blocked ? "border-error/40 bg-error/5" : "border-border/50 bg-surface/40"
+        }`}>
+          <div className="min-w-0 space-y-0.5">
+            <div className={`flex items-center gap-1.5 text-xs font-medium ${dailyGuard.enabled && dailyGuard.state.blocked ? "text-error" : "text-text-secondary"}`}>
+              <span>Daily guard</span>
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <button type="button" aria-label="About Daily guard" className="text-text-subtle hover:text-text-primary cursor-help">
+                    <CircleHelp className="size-3.5" />
+                  </button>
+                </TooltipTrigger>
+                <TooltipContent side="top" className="max-w-64 text-xs leading-relaxed">
+                  Keeps a weekly-only Codex account on pace to last until its reset. Each day adds one seventh of the weekly quota. When usage reaches that day's cap, PPM pauses new turns until the next day.
+                </TooltipContent>
+              </Tooltip>
+            </div>
+            <p className={`text-[10px] tabular-nums ${dailyGuard.enabled && dailyGuard.state.blocked ? "text-error" : "text-text-subtle"}`}>
+              {dailyGuard.enabled && dailyGuard.state.blocked
+                ? `${Math.round(dailyGuard.state.used * 100)}% used / ${Math.round(dailyGuard.state.cap * 100)}% daily cap. New turns paused.`
+                : `Day ${dailyGuard.state.day}/7, ${Math.round(dailyGuard.state.cap * 100)}% daily cap`}
+            </p>
+          </div>
+          {onDailyGuardToggle && (
+            <Switch
+              checked={dailyGuard.enabled}
+              onCheckedChange={onDailyGuardToggle}
+              disabled={dailyGuardToggling}
+              aria-label={dailyGuard.enabled ? "Disable Daily guard" : "Enable Daily guard"}
+              className="cursor-pointer shrink-0"
+            />
+          )}
+        </div>
+      )}
+
       <div className="flex items-center gap-2 text-[10px] text-text-subtle flex-wrap">
         {usage.lastFetchedAt && (
           <AccountHint

package/src/web/components/settings/accounts/codex-accounts-section.tsx

@@ -7,7 +7,7 @@
  */
 
 import { useState } from "react";
-import { Download, KeyRound, Loader2, Plus, Settings, Trash2, Upload } from "lucide-react";
+import { CircleHelp, Download, KeyRound, Loader2, Plus, Settings, Trash2, Upload } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { Switch } from "@/components/ui/switch";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
@@ -17,6 +17,8 @@ import { CodexBackupDialog } from "./codex-backup-dialog";
 import { CodexRotationDialog } from "./codex-rotation-dialog";
 import { CodexUsageRows } from "./codex-usage-rows";
 import { useCodexAccounts } from "./use-codex-accounts";
+import { codexPlanLabel } from "../../../../shared/codex-plan-label.ts";
+import { dailyGuardState } from "../../../../shared/codex-daily-guard.ts";
 
 /** Codex multi-account management, separate from Claude accounts because codex auth is owned
  *  by the app-server per CODEX_HOME. Added by API key, browser login, or ChatGPT device code. */
@@ -86,7 +88,7 @@ export function CodexAccountsSection() {
                     <span className="text-[10px] uppercase tracking-wide text-text-subtle border border-border rounded px-1 shrink-0">
                       {a.type}
                     </span>
-                    {a.planType && <span className="text-[10px] text-text-subtle shrink-0">{a.planType}</span>}
+                    {codexPlanLabel(a.planType) && <span className="text-[10px] text-text-subtle shrink-0">{codexPlanLabel(a.planType)}</span>}
                     {/* Same control the Claude card uses, in the same place, so the two
                         sub-tabs read as one screen rather than two designs. */}
                     <Switch
@@ -111,6 +113,45 @@ export function CodexAccountsSection() {
                     </Tooltip>
                   </div>
                   <CodexUsageRows usage={u} />
+                  {u.session == null && (() => {
+                    const guard = dailyGuardState(u.weekly);
+                    return guard ? (
+                      <div className={`flex min-h-12 items-center justify-between gap-3 rounded-md border px-2.5 py-1.5 ${
+                        a.dailyGuardEnabled && guard.blocked ? "border-error/40 bg-error/5" : "border-border/50 bg-surface/40"
+                      }`}>
+                        <div className="min-w-0 space-y-0.5">
+                          <div className={`flex items-center gap-1.5 text-xs font-medium ${a.dailyGuardEnabled && guard.blocked ? "text-error" : "text-text-secondary"}`}>
+                            <span>Daily guard</span>
+                            <Tooltip>
+                              <TooltipTrigger asChild>
+                                <button type="button" aria-label="About Daily guard" className="text-text-subtle hover:text-text-primary cursor-help">
+                                  <CircleHelp className="size-3.5" />
+                                </button>
+                              </TooltipTrigger>
+                              <TooltipContent side="top" className="max-w-64 text-xs leading-relaxed">
+                                Keeps a weekly-only Codex account on pace to last until its reset. Each day adds one seventh of the weekly quota. When usage reaches that day's cap, PPM pauses new turns until the next day. Turn it off any time to use the remaining quota freely.
+                              </TooltipContent>
+                            </Tooltip>
+                          </div>
+                          <p className={`text-[10px] tabular-nums ${a.dailyGuardEnabled && guard.blocked ? "text-error" : "text-text-subtle"}`}>
+                            {a.dailyGuardEnabled && guard.blocked
+                              ? `${Math.round(guard.used * 100)}% used / ${Math.round(guard.cap * 100)}% daily cap. New turns paused.`
+                              : `Day ${guard.day}/7, ${Math.round(guard.cap * 100)}% daily cap`}
+                          </p>
+                        </div>
+                        <span className="hidden" title={`Day ${guard.day}/7: hold weekly usage at or below ${Math.round(guard.cap * 100)}% to last until reset.`}>
+                          Daily guard {a.dailyGuardEnabled ? `· Day ${guard.day}/7 cap ${Math.round(guard.cap * 100)}%` : ""}
+                        </span>
+                        <Switch
+                          checked={!!a.dailyGuardEnabled}
+                          onCheckedChange={() => void c.toggleDailyGuard(a.id, !!a.dailyGuardEnabled)}
+                          disabled={c.toggling.has(a.id)}
+                          aria-label={a.dailyGuardEnabled ? "Disable Daily guard" : "Enable Daily guard"}
+                          className="cursor-pointer shrink-0"
+                        />
+                      </div>
+                    ) : null;
+                  })()}
                 </AccountCardShell>
               );
             })}