@hienlh/ppm 0.23.1 → 0.23.3

package/src/providers/codex-app-server/codex-provider.ts

@@ -26,6 +26,10 @@ import {
 import { dailyGuardMessage, dailyGuardState } from "../../shared/codex-daily-guard.ts";
 import { isCodexAccountUsageLimited, markCodexAccountUsageLimited } from "../../services/codex-account-cooldown.ts";
 import { isCodexUsageLimit, codexErrorMessage, parseCodexUsageLimitReset } from "./codex-usage-limit.ts";
+import { isCodexAuthFailure, codexErrorText, codexSignedOutMessage } from "./codex-auth-failure.ts";
+import {
+  isCodexAccountAuthFailed, markCodexAccountAuthFailed, clearCodexAccountAuthFailure,
+} from "../../services/codex-account-auth-state.ts";
 import { killProcessTree } from "../../services/windows-process-tree.ts";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -181,8 +185,16 @@ interface LiveSession {
   /** The turn currently in flight, kept so a rotation can send it again on the new
    *  account. Cleared when the turn ends — there is then nothing to replay. */
   lastTurnInput?: { message: string; opts?: SendMessageOpts };
+  /** The running turn has already been reported as failed (its account is signed out) and
+   *  interrupted. Codex keeps narrating it — more retry notices, a final error, then
+   *  `turn/completed` — none of which may reach the caller a second time. Cleared by that
+   *  `turn/completed`, which is also when the queue may move on. */
+  discardingTurn?: boolean;
 }
 
+/** Why a turn is being moved to another account. */
+type RotationKind = "usage" | "auth";
+
 /** A follow-up held back because a turn was already running. */
 interface QueuedTurn {
   message: string;
@@ -516,7 +528,15 @@ export class CodexAppServerProvider implements AIProvider {
       // A quota refusal can come back as the rejection of the request itself rather than
       // as an `error` notification, and it is the same situation either way — move the
       // turn to an account that still has room instead of showing the refusal.
-      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason)) return;
+      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason, "usage")) return;
+      if (isCodexAuthFailure(reason)) {
+        this.markSessionAccountSignedOut(live, reason);
+        if (this.beginRotation(live, reason, "auth")) return;
+        live.channel.push({ type: "error", message: codexSignedOutMessage(this.sessionAccountLabel(live)) });
+        live.channel.push({ type: "done", sessionId: live.threadId ?? "", resultSubtype: "error_during_execution" });
+        this.endTurn(live);
+        return;
+      }
       if (!live.client.isClosed) live.channel.push({ type: "error", message: redactTruncate(reason, 256) });
       // No turn is running, so nothing will report `turn/completed` — release the
       // queue here or every later follow-up waits on a turn that never existed.
@@ -556,6 +576,7 @@ export class CodexAppServerProvider implements AIProvider {
     live.turnInFlight = false;
     live.activeTurnId = null;
     live.interruptRequested = false;
+    live.discardingTurn = false;
     live.lastTurnInput = undefined;
     const next = live.pendingTurns.shift();
     if (next) void this.startTurn(live, next.message, next.opts);
@@ -575,29 +596,64 @@ export class CodexAppServerProvider implements AIProvider {
    * user untouched. That is the honest outcome: an error saying the quota is spent is worth
    * more than a silent retry on the account that just said so.
    */
-  private beginRotation(live: LiveSession, reason: string): boolean {
+  private beginRotation(live: LiveSession, reason: string, kind: RotationKind): boolean {
     const threadId = live.threadId;
     if (!threadId || live.rotating) return false;
     const currentId = getSessionCodexAccount(threadId);
     const candidates = listCodexAccounts().filter(
-      (a) => a.status !== "disabled" && a.id !== currentId && !isCodexAccountUsageLimited(a.id),
+      (a) => a.status !== "disabled" && a.id !== currentId
+        && !isCodexAccountUsageLimited(a.id) && !isCodexAccountAuthFailed(a.id),
     );
     if (candidates.length === 0) return false;
     live.rotating = true;
-    void this.rotateAccount(live, threadId, currentId, reason);
+    void this.rotateAccount(live, threadId, currentId, reason, kind);
     return true;
   }
 
-  /** Park the spent account, move the session onto a fresh one, and send the turn again. */
+  /** Mark the account serving this session as signed out, if it is a managed one. */
+  private markSessionAccountSignedOut(live: LiveSession, reason: string): void {
+    const accountId = live.threadId ? getSessionCodexAccount(live.threadId) : null;
+    if (accountId) markCodexAccountAuthFailed(accountId, redactTruncate(reason, 256));
+  }
+
+  private sessionAccountLabel(live: LiveSession): string | null {
+    const accountId = live.threadId ? getSessionCodexAccount(live.threadId) : null;
+    return accountId ? getCodexAccount(accountId)?.label ?? null : null;
+  }
+
+  /**
+   * The running turn's account turned out to be signed out.
+   *
+   * Recognised on codex's FIRST retry notice rather than its final error: the notice already
+   * names the 401, and waiting out the rest of the loop is ~24s of a subprocess and a request
+   * held open for an answer that cannot come. Moves the turn to another account when one can
+   * take it; otherwise reports it and interrupts the turn, discarding what codex still says
+   * about it.
+   */
+  private handleAuthFailure(live: LiveSession, reason: string): void {
+    this.markSessionAccountSignedOut(live, reason);
+    if (this.beginRotation(live, reason, "auth")) return;
+    live.discardingTurn = true;
+    this.interruptActiveTurn(live);
+    live.channel.push({ type: "error", message: codexSignedOutMessage(this.sessionAccountLabel(live)) });
+    live.channel.push({ type: "done", sessionId: live.threadId ?? "", resultSubtype: "error_during_execution" });
+  }
+
+  /** Bench the refused account, move the session onto a fresh one, and send the turn again. */
   private async rotateAccount(
     live: LiveSession,
     threadId: string,
     currentId: string | null,
     reason: string,
+    kind: RotationKind,
   ): Promise<void> {
     const pending = live.lastTurnInput;
-    const reset = parseCodexUsageLimitReset(reason);
-    if (currentId) markCodexAccountUsageLimited(currentId, reset?.atMs);
+    const reset = kind === "usage" ? parseCodexUsageLimitReset(reason) : null;
+    // A signed-out account was already marked by the caller; only a quota refusal parks here.
+    if (currentId && kind === "usage") markCodexAccountUsageLimited(currentId, reset?.atMs);
+    const giveUp = (): void => this.abandonRotation(live, kind === "auth"
+      ? codexSignedOutMessage(currentId ? getCodexAccount(currentId)?.label : null)
+      : this.usageLimitMessage(reason, reset?.text));
 
     let next: CodexAccount | null = null;
     try {
@@ -612,12 +668,12 @@ export class CodexAppServerProvider implements AIProvider {
       next = selectCodexAccount(currentId ? { exclude: [currentId] } : undefined);
     }
 
-    if (!next) { this.abandonRotation(live, reason, reset?.text); return; }
+    if (!next) { giveUp(); return; }
 
-    console.warn(`[codex] session=${threadId} usage limit — switching to ${next.id} (${next.label})`);
+    console.warn(`[codex] session=${threadId} ${kind === "auth" ? "account signed out" : "usage limit"} — switching to ${next.id} (${next.label})`);
     live.channel.push({
       type: "account_retry",
-      reason: "Usage limit reached — switching account",
+      reason: kind === "auth" ? "Account signed out — switching account" : "Usage limit reached — switching account",
       accountId: next.id,
       accountLabel: next.label,
     });
@@ -626,7 +682,7 @@ export class CodexAppServerProvider implements AIProvider {
       await this.respawnOn(live, threadId, next);
     } catch (e) {
       console.error(`[codex] session=${threadId} rotation to ${next.id} failed: ${redactTruncate((e as Error)?.message, 200)}`);
-      this.abandonRotation(live, reason, reset?.text);
+      giveUp();
       return;
     }
 
@@ -639,14 +695,15 @@ export class CodexAppServerProvider implements AIProvider {
     else this.endTurn(live);
   }
 
+  private usageLimitMessage(reason: string, resetText?: string): string {
+    const suffix = resetText ? ` Try again ${resetText}.` : "";
+    return `${redactTruncate(reason, 512)}${suffix} Add another account in Settings → Accounts, or wait for the reset.`;
+  }
+
   /** No account could take the turn — report the refusal and close the turn out. */
-  private abandonRotation(live: LiveSession, reason: string, resetText?: string): void {
+  private abandonRotation(live: LiveSession, message: string): void {
     live.rotating = false;
-    const suffix = resetText ? ` Try again ${resetText}.` : "";
-    live.channel.push({
-      type: "error",
-      message: `${redactTruncate(reason, 512)}${suffix} Add another account in Settings → Accounts, or wait for the reset.`,
-    });
+    live.channel.push({ type: "error", message });
     live.channel.push({ type: "done", sessionId: live.threadId ?? "", resultSubtype: "error_during_execution" });
     this.endTurn(live);
   }
@@ -823,30 +880,58 @@ export class CodexAppServerProvider implements AIProvider {
   }
 
   private handleNotification(live: LiveSession, notif: JsonRpcNotification): void {
+    // One app-server also streams spawned threads. Resolve ownership before any
+    // turn/account state changes, even if the child's launch card has not arrived.
+    const notificationThreadId = threadIdFromNotification(notif.params);
+    const isChild = !!notificationThreadId && (live.threadId
+      ? notificationThreadId !== live.threadId
+      : live.subagentThreadIds.has(notificationThreadId));
+    const parentToolUseId = isChild ? subagentCardId(notificationThreadId!) : undefined;
     // A quota refusal is an ordinary `error` notification, so it has to be recognised
     // before the mapper turns it into a plain error card in front of the user.
-    if (notif.method === "error" && !live.rotating) {
+    if (!isChild && notif.method === "error" && !live.rotating && !live.discardingTurn) {
+      // Retry notices count too: the headline says only "Reconnecting... N/5", but their
+      // details name the 401, and waiting for the final error costs the whole retry loop.
+      const authText = codexErrorText(notif.params);
+      if (isCodexAuthFailure(authText)) { this.handleAuthFailure(live, authText); return; }
       const reason = codexErrorMessage(notif.params);
-      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason)) return;
+      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason, "usage")) return;
     }
     // Mid-rotation the subprocess behind this session is being replaced. Anything it still
     // emits describes the turn that was refused — including its `turn/completed`, which
     // would close the turn the caller is about to be given a second time.
     if (live.rotating) return;
-    if (notif.method === "item/agentMessage/delta") {
+    // A turn already reported as failed: swallow the rest of it, and let the queue move on
+    // only once codex confirms it is over.
+    if (live.discardingTurn) {
+      if (!isChild && notif.method === "turn/completed") {
+        live.discardingTurn = false;
+        live.currentAssistant = "";
+        live.currentEvents = [];
+        this.endTurn(live);
+      }
+      return;
+    }
+    if (!isChild && notif.method === "turn/completed"
+        && (notif.params as { turn?: { status?: string } })?.turn?.status === "completed" && live.threadId) {
+      // An answered turn is proof the login works, whatever was observed before.
+      const accountId = getSessionCodexAccount(live.threadId);
+      if (accountId) clearCodexAccountAuthFailure(accountId);
+    }
+    if (!isChild && notif.method === "item/agentMessage/delta") {
       const d = (notif.params as { delta?: string })?.delta;
       if (typeof d === "string") live.currentAssistant += d;
     }
-    if (notif.method === "thread/tokenUsage/updated") {
+    if (!isChild && notif.method === "thread/tokenUsage/updated") {
       const usage = parseTokenUsage(notif.params, live.model);
       if (usage) live.lastUsage = usage;
     }
-    const notificationThreadId = threadIdFromNotification(notif.params);
-    const parentToolUseId = notificationThreadId && live.subagentThreadIds.has(notificationThreadId)
-      ? subagentCardId(notificationThreadId)
-      : undefined;
     const events = mapCodexEvent(notif, live.threadId ?? "");
     for (const ev of events) {
+      // Child lifecycle notifications must never terminate or change the phase
+      // of the root stream. Keep only content and diagnostics under its card.
+      if (isChild && ev.type !== "text" && ev.type !== "thinking"
+          && ev.type !== "tool_use" && ev.type !== "tool_result" && ev.type !== "error") continue;
       // The counts arrive on their own notification just before the turn ends,
       // so `done` is where they become visible to a consumer.
       if (ev.type === "done" && live.lastUsage) {
@@ -856,13 +941,13 @@ export class CodexAppServerProvider implements AIProvider {
       const nested = parentToolUseId ? { ...ev, parentToolUseId } as ChatEvent : ev;
       live.channel.push(nested);
       // Accumulate tool calls into the turn so getMessages (live) keeps them.
-      if (nested.type === "tool_use" || nested.type === "tool_result") live.currentEvents.push(nested);
+      if ((!isChild || live.turnInFlight) && (nested.type === "tool_use" || nested.type === "tool_result")) live.currentEvents.push(nested);
       if (nested.type === "tool_use" && nested.tool === "Agent" && typeof nested.toolUseId === "string"
           && nested.toolUseId.startsWith("subagent-")) {
         live.subagentThreadIds.add(nested.toolUseId.slice("subagent-".length));
       }
     }
-    if (notif.method === "turn/completed") {
+    if (!isChild && notif.method === "turn/completed") {
       if (live.currentAssistant || live.currentEvents.length) {
         const turnEvents = live.currentEvents.length
           ? [...live.currentEvents, ...(live.currentAssistant ? [{ type: "text", content: live.currentAssistant } as ChatEvent] : [])]
@@ -876,7 +961,7 @@ export class CodexAppServerProvider implements AIProvider {
       live.currentEvents = [];
       this.endTurn(live);
     }
-    if (notif.method === "turn/started") {
+    if (!isChild && notif.method === "turn/started") {
       // Codex is the authority on whether the thread is busy — take the flag from
       // it rather than only from what this side believes it started.
       live.turnInFlight = true;
@@ -887,7 +972,7 @@ export class CodexAppServerProvider implements AIProvider {
     // (the thread/compacted notification is deprecated). Surface the compact-summary
     // marker inline so the chat UI offers "load previous conversation". The turn's
     // own turn/completed provides the `done`.
-    if (notif.method === "item/completed" && live.compactRequested
+    if (!isChild && notif.method === "item/completed" && live.compactRequested
         && (notif.params as { item?: { type?: string } })?.item?.type === "contextCompaction") {
       live.compactRequested = false;
       const file = fromCodexSessionsDirs(live.threadId ?? undefined,

package/src/providers/codex-app-server/codex-usage-parser.ts

@@ -1,6 +1,7 @@
 import type { UsageInfo, LimitBucket } from "../provider.interface.ts";
 import type { GetAccountRateLimitsResponse, RateLimitWindow } from "./codex-protocol.ts";
 import { codexPlanLabel } from "../../shared/codex-plan-label.ts";
+import { parseCodexResetCredits } from "../../shared/usage-extra.ts";
 
 /** codex resetsAt is a unix timestamp; tolerate seconds or milliseconds. */
 function toIso(resetsAt: number | null | undefined): string | undefined {
@@ -67,5 +68,8 @@ export function parseCodexUsage(res: GetAccountRateLimitsResponse | null | undef
   });
   const planLabel = codexPlanLabel(snap.planType);
   if (planLabel) out.activeAccountLabel = planLabel;
+  // Free "reset my limits" grants sit beside the windows, not inside them.
+  const resetCredits = parseCodexResetCredits(res);
+  if (resetCredits) out.resetCredits = resetCredits;
   return out;
 }

package/src/providers/codex-app-server/codex-usage-source.ts

@@ -3,6 +3,8 @@ import type { ProviderUsageSource } from "../../services/provider-usage/usage-so
 import { AMBIENT_ACCOUNT_KEY } from "../../services/provider-usage/usage-source.ts";
 import { listCodexAccounts, getCodexAccount } from "../../services/codex-account.service.ts";
 import { fetchCodexUsageLive } from "./codex-usage-fetch.ts";
+import { isCodexAuthFailure } from "./codex-auth-failure.ts";
+import { markCodexAccountAuthFailed, clearCodexAccountAuthFailure } from "../../services/codex-account-auth-state.ts";
 
 /**
  * Codex's plug into the shared usage layer.
@@ -29,7 +31,18 @@ export const codexUsageSource: ProviderUsageSource = {
     // object would be persisted as a real reading for an account that is gone.
     if (!account) throw new Error(`codex account ${accountId} no longer exists`);
 
-    const usage = await fetchCodexUsageLive(account.home);
+    let usage: UsageInfo;
+    try {
+      usage = await fetchCodexUsageLive(account.home);
+    } catch (e) {
+      // The sweep is the one thing that reads every account on a timer, so it is what keeps
+      // a signed-out account benched between turns — and what notices it first, before any
+      // turn is spent on it.
+      const message = (e as Error)?.message ?? String(e);
+      if (isCodexAuthFailure(message)) markCodexAccountAuthFailed(account.id, message.slice(0, 256));
+      throw e;
+    }
+    clearCodexAccountAuthFailure(account.id);
     // The rate-limit payload carries the plan name, which the parser puts in
     // activeAccountLabel; the account's own label is the truthful one.
     return { ...usage, activeAccountId: account.id, activeAccountLabel: account.label };

package/src/server/index.ts

@@ -615,7 +615,13 @@ export async function startServer(options: {
       while (superviseArgs.length > 1 && superviseArgs[superviseArgs.length - 1] === "") superviseArgs.pop();
 
       const bunExe = process.execPath.replace(/\\/g, "\\\\");
-      const logEscaped = logFile.replace(/\\/g, "\\\\");
+      // Never ppm.log itself: `-RedirectStandardOutput` opens its target with
+      // truncate, not append, so every `ppm start` wiped the whole log since the
+      // last rotation — and the handle it holds writes at its own offset, over
+      // lines the supervisor and server append. The supervisor's `log()` and the
+      // descriptor it hands the server already append everything to ppm.log;
+      // this file only catches the supervisor's raw console output.
+      const outLog = logFile.replace(/\.log$/, ".out.log").replace(/\\/g, "\\\\");
       const errLog = logFile.replace(/\.log$/, ".err.log").replace(/\\/g, "\\\\");
       const winArgs = isCompiledBin ? superviseArgs : ["run", supervisorScript, ...superviseArgs];
       const argStr = winArgs.map((a) => `'${a || "_"}'`).join(",");
@@ -623,7 +629,7 @@ export async function startServer(options: {
         `$p = Start-Process -PassThru -WindowStyle Hidden`,
         `-FilePath '${bunExe}'`,
         `-ArgumentList ${argStr}`,
-        `-RedirectStandardOutput '${logEscaped}'`,
+        `-RedirectStandardOutput '${outLog}'`,
         `-RedirectStandardError '${errLog}'`,
         `; Write-Output $p.Id`,
       ].join(" ");

package/src/server/routes/chat.ts

@@ -158,6 +158,7 @@ chatRoutes.get("/usage", async (c) => {
     weekly: usage.weekly,
     weeklyOpus: usage.weeklyOpus,
     weeklySonnet: usage.weeklySonnet,
+    weeklyScoped: usage.weeklyScoped,
     totalCostUsd: usage.totalCostUsd,
     activeAccountId: usage.activeAccountId,
     activeAccountLabel: usage.activeAccountLabel,

package/src/server/routes/codex-accounts.ts

@@ -3,11 +3,20 @@ import { ok, err } from "../../types/api.ts";
 import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, setCodexDailyGuard, codexUsageLevel, type CodexStrategy } from "../../services/codex-account.service.ts";
 import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin, startBrowserLogin, submitBrowserCallback, getBrowserLoginStatus, cancelBrowserLogin } from "../../services/codex-account-login.ts";
 import { exportCodexEncrypted, importCodexEncrypted } from "../../services/codex-account-portability.ts";
+import { isCodexAccountAuthFailed } from "../../services/codex-account-auth-state.ts";
 
 /** Codex multi-account management. Mounted under /api/codex-accounts (auth-guarded). */
 export const codexAccountsRoutes = new Hono();
 
-codexAccountsRoutes.get("/", (c) => c.json(ok({ accounts: listCodexAccounts(), strategy: getCodexStrategy() })));
+/**
+ * `signedOut` is the server's live observation (a revoked/expired login seen on a turn or a
+ * quota read), not a stored field. The usage endpoint keeps serving the last good reading
+ * for such an account, so without it the card looked healthy while every turn failed.
+ */
+codexAccountsRoutes.get("/", (c) => c.json(ok({
+  accounts: listCodexAccounts().map((a) => ({ ...a, signedOut: isCodexAccountAuthFailed(a.id) })),
+  strategy: getCodexStrategy(),
+})));
 
 /** Per-account quota map { [accountId]: UsageInfo }. */
 codexAccountsRoutes.get("/usage", async (c) => c.json(ok(await getAllCodexUsages())));
@@ -73,10 +82,12 @@ codexAccountsRoutes.post("/api-key", async (c) => {
   catch (e) { return c.json(err((e as Error).message), 400); }
 });
 
-/** Begin ChatGPT device-code login → returns { id, userCode, verificationUrl }. */
+/** Begin ChatGPT device-code login → returns { id, userCode, verificationUrl }.
+ *  With `accountId`, signs that existing account in again instead of adding one. */
 codexAccountsRoutes.post("/device-login", async (c) => {
-  const body = await c.req.json<{ label?: string }>().catch(() => ({} as { label?: string }));
-  try { return c.json(ok(await startDeviceLogin(body.label))); }
+  const body = await c.req.json<{ label?: string; accountId?: unknown }>().catch(() => ({} as { label?: string; accountId?: unknown }));
+  if (body.accountId !== undefined && typeof body.accountId !== "string") return c.json(err("accountId must be a string"), 400);
+  try { return c.json(ok(await startDeviceLogin(body.label, undefined, body.accountId))); }
   catch (e) { return c.json(err((e as Error).message), 400); }
 });
 
@@ -92,10 +103,11 @@ codexAccountsRoutes.delete("/device-login/:id", (c) => {
 
 /** Browser OAuth uses the same durable polling as device-code login. */
 codexAccountsRoutes.post("/browser-login", async (c) => {
-  const body = await c.req.json<{ label?: string }>().catch(() => ({} as { label?: string }));
+  const body = await c.req.json<{ label?: string; accountId?: unknown }>().catch(() => ({} as { label?: string; accountId?: unknown }));
   if (body.label !== undefined && typeof body.label !== "string") return c.json(err("label must be a string"), 400);
+  if (body.accountId !== undefined && typeof body.accountId !== "string") return c.json(err("accountId must be a string"), 400);
   c.header("Cache-Control", "no-store");
-  try { return c.json(ok(await startBrowserLogin(body.label))); }
+  try { return c.json(ok(await startBrowserLogin(body.label, undefined, body.accountId))); }
   catch (e) { return c.json(err((e as Error).message), 400); }
 });
 

package/src/server/ws/chat.ts

@@ -376,7 +376,7 @@ function bufferAndBroadcast(sessionId: string, event: unknown): void {
 }
 
 /**
- * Emit a nested-agent child read off disk. Buffered for reconnect replay only
+ * Emit a nested-agent child from the provider or disk. Buffered for reconnect replay only
  * while its turn is still in flight and under the nested budget; a background
  * agent that outlives the turn streams its children unbuffered, since the next
  * turn's replay is not the place for them and reload restores them from disk.
@@ -633,6 +633,20 @@ async function startSessionConsumer(sessionId: string, providerId: string, conte
       const ev = event as any;
       const evType = ev.type ?? "unknown";
 
+      // Child streams can outlive the root turn. Their content and terminal
+      // events belong to the Agent card, never to the root turn's lifecycle.
+      if (ev.parentToolUseId) {
+        emitNestedChild(sessionId, event);
+        continue;
+      }
+      // Codex's synthetic Agent card result has no parentToolUseId. A late
+      // completion still updates connected cards, but cannot start a root turn
+      // or create replay that would replace the completed assistant history.
+      if (evType === "tool_result" && ev.toolUseId?.startsWith("subagent-") && entry.phase === "idle") {
+        broadcast(sessionId, event);
+        continue;
+      }
+
       // System events → transition connecting → thinking, forward compact events
       if (evType === "system") {
         const sub = (ev as any).subtype;
@@ -929,6 +943,7 @@ async function startSessionConsumer(sessionId: string, providerId: string, conte
       // Consumer loop continues — query waits for next message in generator
       if (evType === "done") {
         entry.turnEvents = [];
+        entry.nestedBuffered = 0;
         entry.pendingApprovalEvent = undefined;
         // Clear stale compact status if turn ended without compact_boundary.
         // SDK may emit `status: compacting` without a matching boundary (deferred,

package/src/services/claude-usage.service.ts

@@ -15,6 +15,8 @@ import { startProviderUsagePolling, stopProviderUsagePolling, sweepUsageSource }
 import { refreshUsage as refreshProviderUsage } from "./provider-usage/usage-registry.ts";
 import { claudeUsageSource } from "./claude-usage-source.ts";
 import { resetUsageRuntimeState } from "./provider-usage/index.ts";
+import { deserializeUsageExtra, parseClaudeScopedLimits, scopedBucket } from "../shared/usage-extra.ts";
+import type { ScopedLimitBucket } from "../types/chat.ts";
 
 export interface LimitBucket {
   utilization: number;
@@ -30,6 +32,8 @@ export interface ClaudeUsage {
   weekly?: LimitBucket;
   weeklyOpus?: LimitBucket;
   weeklySonnet?: LimitBucket;
+  /** Per-model weekly limits ("Fable", …) — see `shared/usage-extra.ts`. */
+  weeklyScoped?: ScopedLimitBucket[];
   totalCostUsd?: number;
 }
 
@@ -93,6 +97,8 @@ function snapshotToUsage(row: LimitSnapshotRow): ClaudeUsage {
   if (row.weekly_util != null) result.weekly = dbBucketToLimitBucket(row.weekly_util, row.weekly_resets_at ?? "", 168);
   if (row.weekly_opus_util != null) result.weeklyOpus = dbBucketToLimitBucket(row.weekly_opus_util, row.weekly_opus_resets_at ?? "", 168);
   if (row.weekly_sonnet_util != null) result.weeklySonnet = dbBucketToLimitBucket(row.weekly_sonnet_util, row.weekly_sonnet_resets_at ?? "", 168);
+  const { weeklyScoped } = deserializeUsageExtra(row.extra_json);
+  if (weeklyScoped) result.weeklyScoped = weeklyScoped;
   return result;
 }
 
@@ -124,6 +130,13 @@ async function fetchUsageForToken(token: string): Promise<ClaudeUsage> {
   if (raw.seven_day) data.weekly = parseApiBucket(raw.seven_day, 168);
   if (raw.seven_day_opus) data.weeklyOpus = parseApiBucket(raw.seven_day_opus, 168);
   if (raw.seven_day_sonnet) data.weeklySonnet = parseApiBucket(raw.seven_day_sonnet, 168);
+  // A model with its own weekly cap (Fable) is reported only in `limits[]`. When the legacy
+  // opus/sonnet key is also present for the same model, keep the legacy bar and skip the
+  // duplicate rather than showing one limit twice.
+  const scoped = parseClaudeScopedLimits(raw)
+    .filter((s) => !(data.weeklyOpus && /^opus\b/i.test(s.label)) && !(data.weeklySonnet && /^sonnet\b/i.test(s.label)))
+    .map(scopedBucket);
+  if (scoped.length) data.weeklyScoped = scoped;
   return data;
 }
 

package/src/services/codex-account-auth-state.ts

@@ -0,0 +1,58 @@
+/**
+ * Codex accounts the server has seen refused for a revoked or expired login.
+ *
+ * Sibling of `codex-account-cooldown.ts`, and in memory for the same reason: this is the
+ * server's own observation, not the user's on/off switch, and writing it into the account
+ * row would show an account the user never touched as changed in Settings.
+ *
+ * Unlike a quota park this is a hard exclusion from selection. A spent quota still answers
+ * slowly; a signed-out account never answers at all, and every turn handed to it costs a
+ * subprocess and ~24s of codex retrying before it says so. That is what let a burst of
+ * proxy requests pin the server until the supervisor killed it.
+ *
+ * The mark lapses on its own so a misread error cannot bench an account forever, and the
+ * usage sweep (every 5 minutes) renews it for as long as the account really is signed out.
+ * A successful usage read, a completed turn or a fresh sign-in clears it at once.
+ */
+
+const MARK_TTL_MS = 15 * 60 * 1000;
+
+interface AuthFailure {
+  until: number;
+  reason: string;
+  since: number;
+}
+
+const failures = new Map<string, AuthFailure>();
+
+/** Record that this account's login was refused. */
+export function markCodexAccountAuthFailed(accountId: string, reason: string): void {
+  const now = Date.now();
+  const prev = failures.get(accountId);
+  const fresh = !prev || prev.until <= now;
+  failures.set(accountId, { until: now + MARK_TTL_MS, reason, since: fresh ? now : prev.since });
+  if (fresh) console.warn(`[codex] account ${accountId} is signed out — skipping it until it signs in again`);
+}
+
+/** Whether the account is currently known to be signed out. Lapsed marks drop as read. */
+export function isCodexAccountAuthFailed(accountId: string): boolean {
+  const f = failures.get(accountId);
+  if (!f) return false;
+  if (f.until <= Date.now()) { failures.delete(accountId); return false; }
+  return true;
+}
+
+/** When the account was first seen signed out, or null if it is not. */
+export function codexAccountAuthFailedSince(accountId: string): number | null {
+  return isCodexAccountAuthFailed(accountId) ? failures.get(accountId)!.since : null;
+}
+
+/** The account answered normally again — drop the mark. */
+export function clearCodexAccountAuthFailure(accountId: string): void {
+  if (failures.delete(accountId)) console.log(`[codex] account ${accountId} is signed in again`);
+}
+
+/** Test seam: forget every mark. */
+export function _resetCodexAuthFailuresForTesting(): void {
+  failures.clear();
+}