@hienlh/ppm 0.23.1 → 0.23.3

package/src/services/codex-account-login.ts

@@ -17,7 +17,9 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync } from "node:fs";
 import { buildCodexCallback, buildCodexSuccessCallback, checkCodexLoginPort, parseBrowserLogin, type BrowserLoginCallback } from "./codex-login-callback.ts";
 import { CodexJsonRpcClient, CONTROL_REQUEST_TIMEOUT_MS } from "../providers/codex-app-server/codex-jsonrpc-client.ts";
-import { codexAccountHome, createCodexAccount, type CodexAccount } from "./codex-account.service.ts";
+import { codexAccountHome, createCodexAccount, getCodexAccount, updateCodexAccountMeta, type CodexAccount } from "./codex-account.service.ts";
+import { clearCodexAccountAuthFailure } from "./codex-account-auth-state.ts";
+import { refreshUsage } from "./provider-usage/usage-registry.ts";
 
 const CLIENT_INFO = { name: "ppm", title: "PPM", version: "0.0.0" };
 const CAPABILITIES = { experimentalApi: true, requestAttestation: false, optOutNotificationMethods: null };
@@ -78,6 +80,9 @@ interface ChatGptLogin {
   browser?: BrowserLoginCallback;
   callbackAbort?: AbortController;
   client: LoginClient; home: string; label?: string;
+  /** Signing an existing account in again: the login runs in that account's own home and
+   *  finalises by updating its row instead of creating one. */
+  reloginId?: string;
   status: DeviceLoginStatus;
   timer: ReturnType<typeof setTimeout>;
   /** True from the completion notification until the account is written. The
@@ -116,7 +121,8 @@ function disposeLogin(id: string, rmHome: boolean): void {
   clearTimeout(p.timer);
   p.callbackAbort?.abort();
   try { p.client.close(); } catch { /* ignore */ }
-  if (rmHome) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
+  // A re-login borrows a live account's home; abandoning it must never delete that.
+  if (rmHome && !p.reloginId) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
 }
 
 /** Record the outcome and stop the app-server. First settle wins, so the close
@@ -131,7 +137,8 @@ function settle(id: string, status: Exclude<DeviceLoginStatus, { state: "pending
   try { p.client.close(); } catch { /* ignore */ }
   // A failure leaves no account owning the dir, so the half-built home goes now.
   // A success must keep it: createCodexAccount adopted it as the account's home.
-  if (status.state === "error") { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
+  // A failed re-login leaves the account's home alone — it still belongs to the account.
+  if (status.state === "error" && !p.reloginId) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
   p.timer = unref(setTimeout(() => { pendingLogins.delete(id); }, RESULT_GRACE_MS));
 }
 
@@ -147,6 +154,21 @@ async function finalizeLogin(id: string, notif: CompletionNotification): Promise
     const read = await p.client.request<AccountRead>("account/read", {}, CONTROL_REQUEST_TIMEOUT_MS);
     if (!read?.account) throw new Error("login completed but account is empty");
     if (p.status.state !== "pending") return;
+    if (p.reloginId) {
+      const existing = getCodexAccount(p.reloginId);
+      if (!existing) throw new Error("That account was removed while signing in. Add it again.");
+      updateCodexAccountMeta(existing.id, {
+        // The label is the user's name for this account ("Work"), not a copy of the email.
+        label: p.label || existing.label,
+        planType: read.account.planType ?? existing.planType ?? null,
+      });
+      // The fresh login is the proof: stop skipping the account and read its quota now,
+      // rather than showing the stale reading until the next five-minute sweep.
+      clearCodexAccountAuthFailure(existing.id);
+      void refreshUsage("codex", existing.id);
+      settle(id, { state: "done", account: getCodexAccount(existing.id)! });
+      return;
+    }
     const account = createCodexAccount({
       id, label: p.label || read.account.email || "ChatGPT", type: "chatgpt",
       planType: read.account.planType ?? null,
@@ -163,12 +185,19 @@ async function startChatGptLogin(
   method: "device" | "browser",
   label: string | undefined,
   makeClient: () => LoginClient,
+  reloginId?: string,
 ): Promise<ChatGptLoginStart> {
   if (method === "browser" && hasPendingBrowserLogin()) {
     throw new Error("A browser login is already in progress. Finish or cancel it first.");
   }
+  // Re-login signs the SAME account in again, in its own CODEX_HOME: the id, the sessions
+  // bound to it, its transcripts and its settings all stay. Removing and re-adding was the
+  // only way before, and it cost every one of those.
+  const target = reloginId ? getCodexAccount(reloginId) : null;
+  if (reloginId && !target) throw new Error("Account not found");
+  if (target && target.type !== "chatgpt") throw new Error("Only a ChatGPT sign-in can be renewed; replace an API key by adding it again.");
   const id = randomUUID();
-  const home = codexAccountHome(id);
+  const home = target ? target.home : codexAccountHome(id);
   mkdirSync(home, { recursive: true, mode: 0o700 });
   const client = makeClient();
   client.onNotification((n) => {
@@ -178,7 +207,10 @@ async function startChatGptLogin(
   });
   client.onClose(() => settle(id, { state: "error", error: "login process exited" }));
   const timer = unref(setTimeout(() => settle(id, { state: "error", error: "timed out" }), method === "browser" ? BROWSER_LOGIN_TTL : DEVICE_LOGIN_TTL));
-  const pending: ChatGptLogin = { method, client, home, label, status: { state: "pending" }, timer, finalizing: false };
+  const pending: ChatGptLogin = {
+    method, client, home, label, status: { state: "pending" }, timer, finalizing: false,
+    ...(target ? { reloginId: target.id } : {}),
+  };
   pendingLogins.set(id, pending);
   try {
     if (method === "browser") await checkCodexLoginPort();
@@ -195,13 +227,14 @@ async function startChatGptLogin(
   }
 }
 
-export async function startDeviceLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient()) {
-  const { id, userCode, verificationUrl } = await startChatGptLogin("device", label, makeClient);
+/** `reloginId` signs that existing ChatGPT account in again instead of adding a new one. */
+export async function startDeviceLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient(), reloginId?: string) {
+  const { id, userCode, verificationUrl } = await startChatGptLogin("device", label, makeClient, reloginId);
   return { id, userCode, verificationUrl };
 }
 
-export async function startBrowserLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient()) {
-  const { id, authUrl } = await startChatGptLogin("browser", label, makeClient);
+export async function startBrowserLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient(), reloginId?: string) {
+  const { id, authUrl } = await startChatGptLogin("browser", label, makeClient, reloginId);
   return { id, authUrl };
 }
 

package/src/services/codex-account.service.ts

@@ -16,6 +16,8 @@ import { configService } from "./config.service.ts";
 import { encrypt, decrypt } from "../lib/account-crypto.ts";
 import { getOrFetchUsage } from "./provider-usage/usage-registry.ts";
 import { isCodexAccountUsageLimited } from "./codex-account-cooldown.ts";
+import { isCodexAccountAuthFailed } from "./codex-account-auth-state.ts";
+import { codexSignedOutMessage } from "../providers/codex-app-server/codex-auth-failure.ts";
 import { dailyGuardMessage, dailyGuardState } from "../shared/codex-daily-guard.ts";
 import type { UsageInfo } from "../providers/provider.interface.ts";
 
@@ -149,6 +151,35 @@ export function setCodexDailyGuard(id: string, enabled: boolean): CodexAccount |
 
 export class CodexDailyGuardError extends Error {}
 
+/** Every managed account that could serve is signed out. */
+export class CodexSignedOutError extends Error {}
+
+/**
+ * Accounts that can be handed a turn at all: switched on, and not known to be signed out.
+ *
+ * Both exclusions are hard. Off is the user's say-so; signed out is an account that will
+ * refuse every turn after ~24s of codex retrying, so handing it back "because nothing else
+ * was left" buys a slow failure instead of a fast one.
+ */
+function servableAccounts(): CodexAccount[] {
+  return listCodexAccounts().filter((a) => a.status !== "disabled" && !isCodexAccountAuthFailed(a.id));
+}
+
+/**
+ * Throw when accounts are enabled but every one of them is signed out.
+ *
+ * Without this the selector finds nothing, the caller falls back to the ambient ~/.codex
+ * login — usually absent or stale on a machine that manages accounts — and the turn fails
+ * with an error that names neither account.
+ */
+function assertSomeAccountSignedIn(): void {
+  const enabled = listCodexAccounts().filter((a) => a.status !== "disabled");
+  if (enabled.length === 0 || enabled.some((a) => !isCodexAccountAuthFailed(a.id))) return;
+  throw new CodexSignedOutError(enabled.length === 1
+    ? codexSignedOutMessage(enabled[0]!.label)
+    : `Every Codex account is signed out (${enabled.map((a) => a.label).join(", ")}). Press "Sign in again" on their cards in Settings → Accounts → Codex.`);
+}
+
 /** Remove the account row and its CODEX_HOME dir. */
 export function removeCodexAccount(id: string): void {
   const acct = getCodexAccount(id);
@@ -242,7 +273,7 @@ export function selectCodexAccount(opts?: { strategy?: CodexStrategy; usageOf?:
   // `exclude` is hard for the same reason: its only caller is the rotation away from an
   // account that just refused the turn, and falling back to it would rotate in a circle.
   const excluded = new Set(opts?.exclude ?? []);
-  const all = listCodexAccounts().filter((a) => a.status !== "disabled" && !excluded.has(a.id));
+  const all = servableAccounts().filter((a) => !excluded.has(a.id));
   if (all.length === 0) return null;
   if (all.length === 1) return all[0]!;
   const strategy = opts?.strategy ?? getCodexStrategy();
@@ -276,7 +307,7 @@ export function peekCodexAccount(): CodexAccount | null {
   // Status and the quota park are the two things this can filter on without going async, so
   // it does both. Usage lives behind a fetch and stays out of reach here; the consuming pick
   // endpoint reads it instead.
-  const accts = withQuotaLeft(listCodexAccounts().filter((a) => a.status !== "disabled"));
+  const accts = withQuotaLeft(servableAccounts());
   if (accts.length === 0) return null;
   if (accts.length === 1) return accts[0]!;
   return getCodexStrategy() === "fill-first" ? accts[0]! : null;
@@ -287,6 +318,11 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
   // Session-less callers (the model list) have nothing sticky to honour and fall
   // straight through to the configured strategy.
   const sticky = sessionId ? getSessionCodexAccount(sessionId) : null;
+  // A signed-out account lets go of its sessions too: it would refuse the turn after
+  // codex's full retry loop, and there is no quota reset to wait for.
+  assertSomeAccountSignedIn();
+  const keepable = (a: CodexAccount | null): a is CodexAccount =>
+    !!a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id) && !isCodexAccountAuthFailed(a.id);
   // A binding is held for the prompt cache, not honoured unconditionally: an account the
   // user has switched off has to let go of the sessions sitting on it, or turning it off
   // would do nothing for exactly the conversations already using it. An account parked for
@@ -296,7 +332,7 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
   // account able to serve it cannot. Parked accounts count as unable for the same reason
   // they are skipped below, so a pool of two where one is out of quota resolves without a
   // network read at all.
-  const usable = listCodexAccounts().filter((a) => a.status !== "disabled" && !isCodexAccountUsageLimited(a.id));
+  const usable = servableAccounts().filter((a) => !isCodexAccountUsageLimited(a.id));
   const guarded = usable.filter((a) => a.dailyGuardEnabled);
   if (guarded.length > 0) {
     const usages = await getAllCodexUsages();
@@ -309,8 +345,7 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
     });
     if (blocked.length > 0) {
       const stickyAccount = sticky ? getCodexAccount(sticky) : null;
-      if (stickyAccount && !blocked.includes(stickyAccount.id)
-          && stickyAccount.status !== "disabled" && !isCodexAccountUsageLimited(stickyAccount.id)) return stickyAccount;
+      if (keepable(stickyAccount) && !blocked.includes(stickyAccount.id)) return stickyAccount;
       if (blocked.length === usable.length && sessionId) {
         const account = getCodexAccount(blocked[0]!);
         const usage = account ? usages[account.id] : undefined;
@@ -321,13 +356,13 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
     }
     if (sticky) {
       const a = getCodexAccount(sticky);
-      if (a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id)) return a;
+      if (keepable(a)) return a;
     }
     return selectCodexAccount({ usageOf: (id) => codexUsageLevel(usages[id]) });
   }
   if (sticky) {
     const a = getCodexAccount(sticky);
-    if (a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id)) return a;
+    if (keepable(a)) return a;
   }
   if (usable.length <= 1) return selectCodexAccount();
   // Usage is read for every strategy, not just lowest-usage: it is also what lets the

package/src/services/db.service.ts

@@ -8,7 +8,7 @@ import { backupDbSync } from "./db-backup/db-backup-sync.ts";
 import { CODEX_DEFAULT_MODEL } from "../types/config.ts";
 // Must equal the last `PRAGMA user_version` below: the pre-migration snapshot is skipped for
 // any database already at this version, so a stale value silently drops that backup.
-export const CURRENT_SCHEMA_VERSION = 50;
+export const CURRENT_SCHEMA_VERSION = 51;
 
 let db: Database | null = null;
 let dbProfile: string | null = null;
@@ -1147,6 +1147,14 @@ export function runMigrations(database: Database): void {
     try { database.exec("ALTER TABLE session_metadata ADD COLUMN permission_mode TEXT"); } catch { /* exists */ }
     database.exec(`PRAGMA user_version = 50;`);
   }
+
+  if (current < 51) {
+    // Usage details that have no fixed column: Claude's per-model weekly limits (Fable and
+    // whatever comes next arrive as `limits[]` entries, not as `seven_day_<model>` keys) and
+    // Codex's free rate-limit reset credits. JSON so a new model needs no migration of its own.
+    try { database.exec("ALTER TABLE claude_limit_snapshots ADD COLUMN extra_json TEXT"); } catch { /* exists */ }
+    database.exec(`PRAGMA user_version = 51;`);
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -1850,6 +1858,8 @@ export interface LimitSnapshotRow {
   weekly_opus_resets_at: string | null;
   weekly_sonnet_util: number | null;
   weekly_sonnet_resets_at: string | null;
+  /** JSON {@link import("../shared/usage-extra.ts").UsageExtra}: per-model weekly limits, reset credits. */
+  extra_json?: string | null;
   recorded_at: string;
 }
 
@@ -1859,8 +1869,8 @@ export function insertLimitSnapshot(
   getDb().query(
     `INSERT INTO claude_limit_snapshots
       (provider, account_id, five_hour_util, five_hour_resets_at, weekly_util, weekly_resets_at,
-       weekly_opus_util, weekly_opus_resets_at, weekly_sonnet_util, weekly_sonnet_resets_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       weekly_opus_util, weekly_opus_resets_at, weekly_sonnet_util, weekly_sonnet_resets_at, extra_json)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     data.provider ?? DEFAULT_USAGE_PROVIDER,
     data.account_id ?? null,
@@ -1868,6 +1878,7 @@ export function insertLimitSnapshot(
     data.weekly_util ?? null, data.weekly_resets_at ?? null,
     data.weekly_opus_util ?? null, data.weekly_opus_resets_at ?? null,
     data.weekly_sonnet_util ?? null, data.weekly_sonnet_resets_at ?? null,
+    data.extra_json ?? null,
   );
 }
 

package/src/services/provider-usage/usage-snapshot-store.ts

@@ -8,6 +8,7 @@ import {
   type LimitSnapshotRow,
 } from "../db.service.ts";
 import { AMBIENT_ACCOUNT_KEY } from "./usage-source.ts";
+import { deserializeUsageExtra, serializeUsageExtra, usageExtraSignature } from "../../shared/usage-extra.ts";
 
 /**
  * The durable half of the usage layer: turning a provider's `UsageInfo` into a
@@ -58,7 +59,7 @@ export function snapshotToUsage(row: LimitSnapshotRow): UsageInfo & { lastFetche
   if (row.weekly_sonnet_util != null) {
     usage.weeklySonnet = toBucket(row.weekly_sonnet_util, row.weekly_sonnet_resets_at ?? "", 168);
   }
-  return usage;
+  return { ...usage, ...deserializeUsageExtra(row.extra_json) };
 }
 
 /** Read the newest stored snapshot for one provider account, or undefined. */
@@ -89,6 +90,7 @@ function hasChanged(usage: UsageInfo, last: LimitSnapshotRow | null): boolean {
   if (moved(usage.weeklySonnet?.utilization, last.weekly_sonnet_util)) return true;
   if (usage.session?.resetsAt && usage.session.resetsAt !== (last.five_hour_resets_at ?? "")) return true;
   if (usage.weekly?.resetsAt && usage.weekly.resetsAt !== (last.weekly_resets_at ?? "")) return true;
+  if (usageExtraSignature(serializeUsageExtra(usage)) !== usageExtraSignature(last.extra_json)) return true;
   return false;
 }
 
@@ -101,7 +103,8 @@ function hasChanged(usage: UsageInfo, last: LimitSnapshotRow | null): boolean {
  */
 export function writeStoredUsage(providerId: string, accountId: string, usage: UsageInfo): void {
   const hasAnyBucket = usage.session != null || usage.weekly != null
-    || usage.weeklyOpus != null || usage.weeklySonnet != null;
+    || usage.weeklyOpus != null || usage.weeklySonnet != null
+    || !!usage.weeklyScoped?.length || usage.resetCredits != null;
   if (!hasAnyBucket) return;
 
   const id = accountId === AMBIENT_ACCOUNT_KEY ? null : accountId;
@@ -121,6 +124,7 @@ export function writeStoredUsage(providerId: string, accountId: string, usage: U
     weekly_opus_resets_at: usage.weeklyOpus?.resetsAt ?? null,
     weekly_sonnet_util: usage.weeklySonnet?.utilization ?? null,
     weekly_sonnet_resets_at: usage.weeklySonnet?.resetsAt ?? null,
+    extra_json: serializeUsageExtra(usage),
   });
   cleanupOldLimitSnapshots();
 }

package/src/services/proxy-agent-anthropic-bridge.ts

@@ -7,7 +7,7 @@
  * setting that base to `…/proxy/<provider>`.
  */
 import {
-  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
+  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds, turnFailureResponse,
 } from "./proxy-agent-turn.ts";
 import {
   buildPromptFromAnthropicMessages, hasUnsupportedAnthropicBlocks, messageResponse, anthropicError,
@@ -99,6 +99,6 @@ export async function forwardAgentMessages(
       ? await runStreaming(providerId, body)
       : await runNonStreaming(providerId, body);
   } catch (e) {
-    return anthropicError(502, (e as Error).message);
+    return turnFailureResponse(e, anthropicError);
   }
 }

package/src/services/proxy-agent-bridge.ts

@@ -15,7 +15,7 @@ import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
-  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
+  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds, turnFailureResponse,
 } from "./proxy-agent-turn.ts";
 import { decodeImagePayload } from "./proxy-image-bridge.ts";
 import {
@@ -140,7 +140,7 @@ export async function forwardAgentChatCompletions(
       ? await runStreaming(providerId, body)
       : await runNonStreaming(providerId, body);
   } catch (e) {
-    return openAiError(502, (e as Error).message);
+    return turnFailureResponse(e, openAiError);
   }
 }
 

package/src/services/proxy-agent-turn.ts

@@ -34,6 +34,54 @@ const PROXY_PERMISSION_MODE = "plan";
 const FIRST_EVENT_TIMEOUT_MS = 90_000;
 const IDLE_TIMEOUT_MS = 300_000;
 
+/**
+ * How many proxy turns may run at once, across every provider and dialect.
+ *
+ * Every turn is its own agent subprocess (codex: `bun x @openai/codex app-server`), and a
+ * client that retries on failure multiplies them: a batch script at concurrency 4 against
+ * a signed-out account kept a dozen app-servers starting and failing at once, and the
+ * server stopped answering its own health check until the supervisor killed it, over and
+ * over. Past this many, a request is refused at once with 429 + Retry-After — which every
+ * OpenAI/Anthropic SDK already backs off on — instead of queueing more subprocesses.
+ */
+export const MAX_CONCURRENT_PROXY_TURNS = 4;
+const BUSY_RETRY_AFTER_S = 5;
+let activeProxyTurns = 0;
+
+/** Refused because {@link MAX_CONCURRENT_PROXY_TURNS} turns are already running. */
+export class ProxyBusyError extends Error {}
+
+/** Current number of running proxy turns (for tests and diagnostics). */
+export function activeProxyTurnCount(): number {
+  return activeProxyTurns;
+}
+
+/** Take a turn slot, or throw {@link ProxyBusyError}. The returned release is idempotent. */
+function acquireTurnSlot(): () => void {
+  if (activeProxyTurns >= MAX_CONCURRENT_PROXY_TURNS) {
+    throw new ProxyBusyError(`Proxy busy: ${MAX_CONCURRENT_PROXY_TURNS} requests are already running. Retry in ${BUSY_RETRY_AFTER_S}s.`);
+  }
+  activeProxyTurns++;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    activeProxyTurns--;
+  };
+}
+
+/**
+ * The error response for a turn that could not run, in the caller's dialect.
+ * A busy refusal is a 429 with Retry-After so SDKs back off; anything else is a 502.
+ */
+export function turnFailureResponse(e: unknown, render: (status: number, message: string) => Response): Response {
+  const message = (e as Error)?.message ?? String(e);
+  if (!(e instanceof ProxyBusyError)) return render(502, message);
+  const res = render(429, message);
+  res.headers.set("Retry-After", String(BUSY_RETRY_AFTER_S));
+  return res;
+}
+
 /** Providers that exist in the registry but must never be exposed over HTTP. */
 const NOT_PROXYABLE = new Set(["mock"]);
 
@@ -133,26 +181,38 @@ export async function startAgentTurn(providerId: string, req: TurnRequest): Prom
   // instructions lead the turn instead.
   const message = req.systemPrompt ? `${req.systemPrompt}\n\n${req.prompt}` : req.prompt;
 
-  const session = await provider.createSession({
-    projectPath: proxyWorkspace(),
-    title: `[API] ${providerId}`,
-  });
-
-  const events = provider.sendMessage(session.id, message, {
-    permissionMode: PROXY_PERMISSION_MODE,
-    ...(req.model ? { model: req.model } : {}),
-    ...(req.imagePaths?.length ? { imagePaths: req.imagePaths } : {}),
-  });
-
-  return {
-    events: withTimeout(events),
-    cleanup: async () => {
-      // abortQuery is what kills the runtime; deleteSession alone may only drop
-      // the record, depending on the provider.
-      try { provider.abortQuery?.(session.id, "proxy"); } catch { /* best effort */ }
-      try { await provider.deleteSession(session.id); } catch { /* best effort */ }
-    },
-  };
+  // Held until cleanup, which every caller runs on every path — including a streaming
+  // response whose body outlives this function.
+  const release = acquireTurnSlot();
+  try {
+    const session = await provider.createSession({
+      projectPath: proxyWorkspace(),
+      title: `[API] ${providerId}`,
+    });
+
+    const events = provider.sendMessage(session.id, message, {
+      permissionMode: PROXY_PERMISSION_MODE,
+      ...(req.model ? { model: req.model } : {}),
+      ...(req.imagePaths?.length ? { imagePaths: req.imagePaths } : {}),
+    });
+
+    return {
+      events: withTimeout(events),
+      cleanup: async () => {
+        try {
+          // abortQuery is what kills the runtime; deleteSession alone may only drop
+          // the record, depending on the provider.
+          try { provider.abortQuery?.(session.id, "proxy"); } catch { /* best effort */ }
+          try { await provider.deleteSession(session.id); } catch { /* best effort */ }
+        } finally {
+          release();
+        }
+      },
+    };
+  } catch (e) {
+    release();
+    throw e;
+  }
 }
 
 /** `<provider>/v1/models` in OpenAI's list shape, so clients can discover models. */

package/src/services/proxy-image-bridge.ts

@@ -21,7 +21,7 @@ import { mkdtempSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, wr
 import { tmpdir } from "node:os";
 import { join, extname } from "node:path";
 import { resolveCodexAccountForSession } from "./codex-account.service.ts";
-import { startAgentTurn, resolveProvider } from "./proxy-agent-turn.ts";
+import { startAgentTurn, resolveProvider, turnFailureResponse } from "./proxy-agent-turn.ts";
 import { openAiError } from "./proxy-openai-format.ts";
 
 /** Providers whose agent can actually produce an image. */
@@ -149,7 +149,7 @@ export async function forwardImageGeneration(providerId: string, body: ImageGene
     const produced = await runImageTurn(providerId, generationPrompt(body), body.model, []);
     return imagesResponse(produced.slice(0, Math.min(Math.max(body.n ?? 1, 1), 4)));
   } catch (e) {
-    return openAiError(502, (e as Error).message);
+    return turnFailureResponse(e, openAiError);
   }
 }
 
@@ -179,7 +179,7 @@ export async function forwardImageEdit(providerId: string, body: ImageEditBody):
     const produced = await runImageTurn(providerId, prompt, body.model, [path]);
     return imagesResponse(produced.slice(0, Math.min(Math.max(body.n ?? 1, 1), 4)));
   } catch (e) {
-    return openAiError(502, (e as Error).message);
+    return turnFailureResponse(e, openAiError);
   } finally {
     try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ }
   }

package/src/services/proxy.service.ts

@@ -198,7 +198,7 @@ class ProxyService {
     insertProxyRequest({
       endpoint, model: parsed.model, accountLabel: providerId,
       callerIp: caller?.callerIp, callerUa: caller?.callerUa,
-      status: response.ok ? "success" : "error", durationMs,
+      status: response.ok ? "success" : response.status === 429 ? "rate_limited" : "error", durationMs,
     });
     console.log(`[proxy] POST ${endpoint} → ${response.status} ${durationMs}ms caller=${caller?.callerIp ?? "unknown"}`);
     return response;

package/src/shared/usage-extra.ts

@@ -0,0 +1,123 @@
+/**
+ * Usage details that have no fixed column: parsed from the provider's payload, stored as
+ * one JSON column on the limit snapshot, and read back into `UsageInfo`.
+ *
+ * Two things live here today, and both would otherwise vanish whenever usage is served from
+ * the stored snapshot rather than a live fetch:
+ *
+ * - Claude's per-model weekly limits. Anthropic stopped filling `seven_day_opus` /
+ *   `seven_day_sonnet` (both null now) and reports a model's own weekly cap as a
+ *   `limits[]` entry of kind `weekly_scoped` with the model's display name — that is how
+ *   "Fable" arrives. Read by name, so the next model shows up without a code change.
+ * - Codex's free rate-limit reset credits (`rateLimitResetCredits`), which say how many
+ *   "reset my limits" grants the account still holds and when they lapse.
+ *
+ * Pure and dependency-free so both the server and the browser can use it.
+ */
+import type { ResetCredits, ScopedLimitBucket } from "../types/chat.ts";
+
+/** A per-model limit as stored: no countdown fields, those are recomputed on read. */
+export interface StoredScopedLimit {
+  label: string;
+  utilization: number;
+  resetsAt: string;
+}
+
+export interface UsageExtra {
+  scoped?: StoredScopedLimit[];
+  resetCredits?: ResetCredits;
+}
+
+const WEEK_HOURS = 168;
+
+/** Recompute a weekly bucket's countdown against the current clock. */
+export function scopedBucket(s: StoredScopedLimit): ScopedLimitBucket {
+  const diff = s.resetsAt ? new Date(s.resetsAt).getTime() - Date.now() : 0;
+  const totalMins = diff > 0 ? Math.ceil(diff / 60_000) : 0;
+  return {
+    label: s.label,
+    utilization: s.utilization,
+    resetsAt: s.resetsAt,
+    resetsInMinutes: null,
+    resetsInHours: Math.round((totalMins / 60) * 100) / 100,
+    windowHours: WEEK_HOURS,
+  };
+}
+
+/**
+ * Claude `limits[]` → per-model weekly limits.
+ *
+ * `percent` is 0–100 like the rest of that payload; stored as a 0–1 fraction like every other
+ * bucket. Entries without a model name are skipped: an unlabelled row would read as a second
+ * "Weekly" bar that disagrees with the real one.
+ */
+export function parseClaudeScopedLimits(raw: unknown): StoredScopedLimit[] {
+  const limits = (raw as { limits?: unknown })?.limits;
+  if (!Array.isArray(limits)) return [];
+  const out: StoredScopedLimit[] = [];
+  for (const l of limits as Array<Record<string, any>>) {
+    if (l?.kind !== "weekly_scoped") continue;
+    const label = l?.scope?.model?.display_name;
+    if (typeof label !== "string" || !label.trim() || typeof l.percent !== "number") continue;
+    out.push({ label: label.trim(), utilization: l.percent / 100, resetsAt: typeof l.resets_at === "string" ? l.resets_at : "" });
+  }
+  return out;
+}
+
+/**
+ * Codex `rateLimitResetCredits` → how many free resets are left and when the next lapses.
+ *
+ * Only credits Codex marks `available` count; a used or expired one is history. Returns
+ * undefined when the payload has no credits block at all, so "none reported" and "0 left"
+ * stay distinguishable.
+ */
+export function parseCodexResetCredits(raw: unknown): ResetCredits | undefined {
+  const block = (raw as { rateLimitResetCredits?: unknown })?.rateLimitResetCredits as
+    { credits?: Array<Record<string, any>> } | null | undefined;
+  if (!block || !Array.isArray(block.credits)) return undefined;
+  const available = block.credits
+    .filter((c) => c?.status === "available")
+    .filter((c) => typeof c.expiresAt !== "number" || c.expiresAt * 1000 > Date.now())
+    .sort((a, b) => (a.expiresAt ?? Infinity) - (b.expiresAt ?? Infinity));
+  const next = available[0];
+  return {
+    available: available.length,
+    ...(typeof next?.expiresAt === "number" ? { nextExpiresAt: new Date(next.expiresAt * 1000).toISOString() } : {}),
+    ...(typeof next?.title === "string" ? { title: next.title } : {}),
+  };
+}
+
+/** The extra fields of a `UsageInfo`, as the JSON column holds them — null when there are none. */
+export function serializeUsageExtra(u: { weeklyScoped?: ScopedLimitBucket[]; resetCredits?: ResetCredits }): string | null {
+  const extra: UsageExtra = {};
+  if (u.weeklyScoped?.length) {
+    extra.scoped = u.weeklyScoped.map((b) => ({ label: b.label, utilization: b.utilization, resetsAt: b.resetsAt }));
+  }
+  if (u.resetCredits) extra.resetCredits = u.resetCredits;
+  return extra.scoped || extra.resetCredits ? JSON.stringify(extra) : null;
+}
+
+/** The JSON column back into `UsageInfo` fields. Malformed JSON reads as nothing, not a throw. */
+export function deserializeUsageExtra(json: string | null | undefined): { weeklyScoped?: ScopedLimitBucket[]; resetCredits?: ResetCredits } {
+  if (!json) return {};
+  let extra: UsageExtra;
+  try { extra = JSON.parse(json) as UsageExtra; } catch { return {}; }
+  return {
+    ...(extra.scoped?.length ? { weeklyScoped: extra.scoped.map(scopedBucket) } : {}),
+    ...(extra.resetCredits ? { resetCredits: extra.resetCredits } : {}),
+  };
+}
+
+/**
+ * What counts as a change worth a new snapshot row.
+ *
+ * Reset timestamps are left out on purpose: Claude's carry microseconds that differ on every
+ * call ("08:59:59.720048" then "09:00:00.363882"), so comparing them would write a row per
+ * sweep. A utilization moving or a credit being granted/used is what matters.
+ */
+export function usageExtraSignature(json: string | null | undefined): string {
+  const e = deserializeUsageExtra(json);
+  const scoped = (e.weeklyScoped ?? []).map((b) => `${b.label}:${b.utilization.toFixed(3)}`).sort().join(",");
+  const credits = e.resetCredits ? `${e.resetCredits.available}@${e.resetCredits.nextExpiresAt ?? ""}` : "";
+  return `${scoped}|${credits}`;
+}

package/src/types/chat.ts

@@ -209,10 +209,29 @@ export interface UsageInfo {
   weekly?: LimitBucket;
   weeklyOpus?: LimitBucket;
   weeklySonnet?: LimitBucket;
+  /** Claude's per-model weekly limits ("Fable", …), labelled by model. */
+  weeklyScoped?: ScopedLimitBucket[];
+  /** Codex's free rate-limit resets still available to this account. */
+  resetCredits?: ResetCredits;
   activeAccountId?: string;
   activeAccountLabel?: string;
 }
 
+/** A weekly limit that applies to one model only, named as the provider names it. */
+export interface ScopedLimitBucket extends LimitBucket {
+  label: string;
+}
+
+/** Free "reset my rate limits" credits Codex grants an account. */
+export interface ResetCredits {
+  /** How many can still be used. */
+  available: number;
+  /** ISO time the soonest-expiring one lapses, if any is available. */
+  nextExpiresAt?: string;
+  /** What the soonest one resets, as Codex words it ("Full reset (Weekly + 5 hr)"). */
+  title?: string;
+}
+
 /** Result subtype from SDK ResultMessage */
 export type ResultSubtype =
   | "success"