@hienlh/ppm 0.23.6 → 0.23.8

package/src/services/chat-prepare/chat-prepare.service.ts

@@ -0,0 +1,135 @@
+import { configService } from "../config.service.ts";
+import { providerRegistry } from "../../providers/registry.ts";
+import { resolveNewChatProvider } from "../../shared/new-chat-provider.ts";
+import type { ChatPreparationSettings } from "../../shared/chat-preparation-settings.ts";
+import { pickClaudeAccount, pickCodexAccount, type PickedAccount } from "../account-pick.service.ts";
+import { readUsageSnapshot, type ChatUsageSnapshot } from "../chat-usage-snapshot.service.ts";
+import { draftService, type DraftData } from "../draft.service.ts";
+import { getTagsByProject, getTagSessionCounts, getProjectDefaultTagId } from "../tag.service.ts";
+import { getSlashRecents } from "../db.service.ts";
+import { listSlashItemsForProvider } from "../slash-items-for-provider.ts";
+import type { SlashItem } from "../slash-discovery/types.ts";
+import { settleWithinBudget } from "./settle-within-budget.ts";
+
+const SLASH_BUDGET_MS = 400;
+const CODEX_USAGE_PICK_BUDGET_MS = 1500;
+const USAGE_BUDGET_MS = 800;
+/** "Effectively instant" (SQLite/memory) parts still get a defensive cap. */
+const DEFAULT_BUDGET_MS = 1000;
+
+export interface PrepareChatBody {
+  providerId?: string;
+  focusedProvider?: string;
+  skipPick?: boolean;
+}
+
+export interface PrepareTagsSnapshot {
+  tags: ReturnType<typeof getTagsByProject>;
+  counts: ReturnType<typeof getTagSessionCounts>;
+  defaultTagId: number | null;
+}
+
+export interface PrepareSlashSnapshot {
+  items: SlashItem[];
+  recentNames: string[];
+}
+
+export interface PrepareChatResult {
+  resolvedProviderId: string;
+  providerId: string;
+  settings: ChatPreparationSettings;
+  providers: { id: string; name: string }[];
+  pickedAccount: PickedAccount | null | "timeout" | "skipped";
+  usage: ChatUsageSnapshot | null;
+  draft: DraftData | null;
+  tags: PrepareTagsSnapshot | null;
+  slash: PrepareSlashSnapshot | null;
+}
+
+export class UnknownProviderError extends Error {
+  constructor(providerId: string) {
+    super(`Provider "${providerId}" not found`);
+  }
+}
+
+/** Only provider selection and permissions are retained; never api_key/api_key_env. */
+function toChatPreparationSettings(): ChatPreparationSettings {
+  const ai = configService.get("ai");
+  return {
+    default_provider: ai.default_provider,
+    new_chat_provider_mode: ai.new_chat_provider_mode,
+    providers: Object.fromEntries(
+      Object.entries(ai.providers).map(([id, provider]) => [id, { permission_mode: provider.permission_mode }]),
+    ),
+  };
+}
+
+/**
+ * Everything a sessionless chat tab needs, in one budgeted request.
+ *
+ * `settings` and `providers` come from in-memory/config reads that cannot meaningfully hang,
+ * so they are never null. Draft, tags and slash items each run under their own budget and
+ * fall back to null rather than delay the response — a timed-out one keeps running in the
+ * background to warm its own cache for the next request. The account pick and its usage run
+ * in parallel with those parts but in sequence with each other: usage has to be read for
+ * whichever account was just picked, and Codex's pick itself is budgeted so a slow usage
+ * fetch never blocks past its own window (see `account-pick.service.ts`).
+ */
+export async function prepareNewChat(projectPath: string, body: PrepareChatBody): Promise<PrepareChatResult> {
+  const settings = toChatPreparationSettings();
+  const resolvedProviderId = resolveNewChatProvider(settings, body.focusedProvider);
+  const providerId = body.providerId || resolvedProviderId;
+  if (!providerRegistry.get(providerId)) throw new UnknownProviderError(providerId);
+
+  const providers = providerRegistry.list();
+
+  const [draft, tags, slash, account] = await Promise.all([
+    settleWithinBudget(
+      (async () => draftService.get(projectPath, "__new__"))(),
+      DEFAULT_BUDGET_MS,
+      null,
+    ),
+    settleWithinBudget(
+      (async (): Promise<PrepareTagsSnapshot> => ({
+        tags: getTagsByProject(projectPath),
+        counts: getTagSessionCounts(projectPath),
+        defaultTagId: getProjectDefaultTagId(projectPath),
+      }))(),
+      DEFAULT_BUDGET_MS,
+      null,
+    ),
+    settleWithinBudget(
+      listSlashItemsForProvider(projectPath, providerId, undefined).then(
+        (items): PrepareSlashSnapshot => ({ items, recentNames: getSlashRecents(projectPath) }),
+      ),
+      SLASH_BUDGET_MS,
+      null,
+    ),
+    body.skipPick
+      ? Promise.resolve({ pickedAccount: "skipped" as const, usage: null })
+      : pickAccountWithUsage(providerId),
+  ]);
+
+  return { resolvedProviderId, providerId, settings, providers, ...account, draft, tags, slash };
+}
+
+/**
+ * The pick, then the usage of whichever account it picked. Sequential by nature — the
+ * usage read needs the picked id — but run as one part beside draft, tags and slash, so
+ * the slowest of those never delays it. A throw from the pick itself propagates, as it
+ * always has: the route answers it with a 500 rather than a tab without an account.
+ */
+async function pickAccountWithUsage(providerId: string): Promise<Pick<PrepareChatResult, "pickedAccount" | "usage">> {
+  let pickedAccount: PickedAccount | null | "timeout";
+  if (providerId === "codex") {
+    pickedAccount = await pickCodexAccount({ usageBudgetMs: CODEX_USAGE_PICK_BUDGET_MS });
+  } else if (providerId === "claude") {
+    pickedAccount = pickClaudeAccount();
+  } else {
+    pickedAccount = null;
+  }
+  const usage: ChatUsageSnapshot | null = pickedAccount && pickedAccount !== "timeout"
+    ? await settleWithinBudget(readUsageSnapshot(providerId, { accountId: pickedAccount.id }), USAGE_BUDGET_MS, null)
+    : null;
+  return { pickedAccount, usage };
+}

package/src/services/chat-prepare/settle-within-budget.ts

@@ -0,0 +1,38 @@
+/**
+ * Race a promise against a budget, without ever rejecting and without ever leaving the
+ * original promise unhandled.
+ *
+ * `/chat/prepare` runs several independent parts (slash items, usage, tags, a draft) under
+ * their own budgets, so a slow one must not delay the rest — it comes back as `fallback`
+ * instead. The original promise is always given both a fulfil and a reject handler, even
+ * after the budget has already resolved this wrapper: a promise nobody is `.catch()`-ing
+ * that rejects later counts as an unhandled rejection, and three of those in 60 seconds
+ * exits the server (see `src/server/index.ts`). `fallback` covers both a timeout and a
+ * genuine rejection — a caller that cannot tell the two apart from the outside is exactly
+ * the point, since both mean "this part did not come back in time to trust it".
+ */
+export function settleWithinBudget<T, F>(promise: Promise<T>, budgetMs: number, fallback: F): Promise<T | F> {
+  return new Promise<T | F>((resolve) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      resolve(fallback);
+    }, budgetMs);
+
+    promise.then(
+      (value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(value);
+      },
+      () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(fallback);
+      },
+    );
+  });
+}

package/src/services/chat-usage-snapshot.service.ts

@@ -0,0 +1,52 @@
+import { providerRegistry } from "../providers/registry.ts";
+import { getCachedUsage } from "./claude-usage.service.ts";
+import { getSessionAccount } from "./db.service.ts";
+import type { UsageInfo } from "../types/chat.ts";
+
+/** `getCachedUsage`'s extra field, carried through so a prepare response can show it too. */
+export interface ChatUsageSnapshot extends UsageInfo {
+  lastFetchedAt?: string;
+}
+
+export interface UsageSnapshotOptions {
+  sessionId?: string;
+  accountId?: string;
+}
+
+/**
+ * Usage for a provider, extracted from `GET /chat/usage` so `/chat/prepare` can read the
+ * same snapshot for the account it just picked, before any session exists to bind it.
+ *
+ * Claude reads the session's bound account when there is one, and falls back to `accountId`
+ * only when there is no session — a session's binding is the authoritative answer once it
+ * exists, and a client-supplied id must never override it.
+ */
+export async function readUsageSnapshot(
+  providerId: string | undefined,
+  opts: UsageSnapshotOptions = {},
+): Promise<ChatUsageSnapshot> {
+  if (providerId && providerId !== "claude") {
+    const provider = providerRegistry.get(providerId);
+    if (provider?.getUsage) {
+      try { return await provider.getUsage(opts.sessionId, opts.accountId); } catch { return {}; }
+    }
+    return {};
+  }
+  const effectiveAccountId = opts.sessionId ? getSessionAccount(opts.sessionId) : opts.accountId;
+  const usage = getCachedUsage(effectiveAccountId ?? undefined);
+  return {
+    lastFetchedAt: usage.lastFetchedAt,
+    fiveHour: usage.session?.utilization,
+    sevenDay: usage.weekly?.utilization,
+    fiveHourResetsAt: usage.session?.resetsAt,
+    sevenDayResetsAt: usage.weekly?.resetsAt,
+    session: usage.session,
+    weekly: usage.weekly,
+    weeklyOpus: usage.weeklyOpus,
+    weeklySonnet: usage.weeklySonnet,
+    weeklyScoped: usage.weeklyScoped,
+    totalCostUsd: usage.totalCostUsd,
+    activeAccountId: usage.activeAccountId,
+    activeAccountLabel: usage.activeAccountLabel,
+  };
+}

package/src/services/codex-account-login.ts

@@ -88,6 +88,8 @@ interface ChatGptLogin {
   /** True from the completion notification until the account is written. The
    * home must survive this window even if the browser walks away. */
   finalizing: boolean;
+  /** Settles on the app-server's account/updated — see finalizeLogin for why it matters. */
+  authReloaded: Promise<void>;
 }
 const pendingLogins = new Map<string, ChatGptLogin>();
 
@@ -142,6 +144,14 @@ function settle(id: string, status: Exclude<DeviceLoginStatus, { state: "pending
   p.timer = unref(setTimeout(() => { pendingLogins.delete(id); }, RESULT_GRACE_MS));
 }
 
+/** Bounded: an app-server that never announces the reload still gets its second read. */
+function waitForAuthReload(p: ChatGptLogin): Promise<void> {
+  return new Promise((resolve) => {
+    const t = unref(setTimeout(resolve, CONTROL_REQUEST_TIMEOUT_MS));
+    void p.authReloaded.then(() => { clearTimeout(t); resolve(); });
+  });
+}
+
 /** Turn the app-server's completion notification into a persisted account. */
 async function finalizeLogin(id: string, notif: CompletionNotification): Promise<void> {
   const p = pendingLogins.get(id);
@@ -151,7 +161,15 @@ async function finalizeLogin(id: string, notif: CompletionNotification): Promise
   // Authorization has completed; account/read has its own bounded timeout.
   clearTimeout(p.timer);
   try {
-    const read = await p.client.request<AccountRead>("account/read", {}, CONTROL_REQUEST_TIMEOUT_MS);
+    let read = await p.client.request<AccountRead>("account/read", {}, CONTROL_REQUEST_TIMEOUT_MS);
+    if (!read?.account) {
+      // codex sends account/login/completed BEFORE it reloads the auth the login just wrote,
+      // and announces the reload with account/updated (send_chatgpt_login_completion_notifications,
+      // rust-v0.154.0). A read that lands in between finds no account, although the sign-in
+      // succeeded — so an empty answer waits for the reload and asks once more.
+      await waitForAuthReload(p);
+      read = await p.client.request<AccountRead>("account/read", {}, CONTROL_REQUEST_TIMEOUT_MS);
+    }
     if (!read?.account) throw new Error("login completed but account is empty");
     if (p.status.state !== "pending") return;
     if (p.reloginId) {
@@ -200,15 +218,21 @@ async function startChatGptLogin(
   const home = target ? target.home : codexAccountHome(id);
   mkdirSync(home, { recursive: true, mode: 0o700 });
   const client = makeClient();
+  // Registered with the completion handler, not after it: the reload can be announced
+  // before the first account/read has even answered.
+  let markAuthReloaded!: () => void;
+  const authReloaded = new Promise<void>((resolve) => { markAuthReloaded = resolve; });
   client.onNotification((n) => {
     if (n.method === "account/login/completed") {
       void finalizeLogin(id, (n.params ?? {}) as CompletionNotification);
+    } else if (n.method === "account/updated") {
+      markAuthReloaded();
     }
   });
   client.onClose(() => settle(id, { state: "error", error: "login process exited" }));
   const timer = unref(setTimeout(() => settle(id, { state: "error", error: "timed out" }), method === "browser" ? BROWSER_LOGIN_TTL : DEVICE_LOGIN_TTL));
   const pending: ChatGptLogin = {
-    method, client, home, label, status: { state: "pending" }, timer, finalizing: false,
+    method, client, home, label, status: { state: "pending" }, timer, finalizing: false, authReloaded,
     ...(target ? { reloginId: target.id } : {}),
   };
   pendingLogins.set(id, pending);

package/src/services/codex-reset-credit.service.ts

@@ -31,13 +31,26 @@ export interface ResetCreditResult {
   usage: UsageInfo;
 }
 
-/** The two ways out to Codex, replaceable so a test can stand in for the app-server. */
+/**
+ * The ways out to Codex, replaceable so a test can stand in for the app-server.
+ *
+ * All three of them. `refresh` was reached directly for a while, which left one door open in
+ * a seam whose whole point is that there are none: a test that faked the other two still made
+ * a real usage read on the way out, and the only sign of it was the call taking whatever the
+ * network took — five seconds and a timeout when something earlier in the process had left a
+ * connection to wait on.
+ */
 export interface ResetCreditCodexPorts {
   readUsage: (codexHome: string) => Promise<UsageInfo>;
   consume: (codexHome: string, idempotencyKey: string, creditId?: string) => Promise<ResetCreditOutcome>;
+  refresh: (accountId: string) => Promise<UsageInfo>;
 }
 
-const LIVE_PORTS: ResetCreditCodexPorts = { readUsage: fetchCodexUsageLive, consume: consumeCodexResetCredit };
+const LIVE_PORTS: ResetCreditCodexPorts = {
+  readUsage: fetchCodexUsageLive,
+  consume: consumeCodexResetCredit,
+  refresh: (accountId) => refreshUsage("codex", accountId),
+};
 
 export async function spendCodexResetCredit(accountId: string, ports: ResetCreditCodexPorts = LIVE_PORTS): Promise<ResetCreditResult> {
   const account = getCodexAccount(accountId);
@@ -63,7 +76,7 @@ export async function spendCodexResetCredit(accountId: string, ports: ResetCredi
     const outcome = await ports.consume(account.home, randomUUID(), live.resetCredits?.nextCreditId);
     if (outcome === "reset") clearCodexAccountUsageLimit(accountId);
     console.log(`[codex] account ${accountId} reset credit → ${outcome}`);
-    return { outcome, usage: await refreshUsage("codex", accountId) };
+    return { outcome, usage: await ports.refresh(accountId) };
   } finally {
     inFlight.delete(accountId);
   }

package/src/services/compaction-savings.ts

@@ -0,0 +1,127 @@
+/**
+ * What each compaction in a transcript cost and saved.
+ *
+ * Compaction is the largest single thing that happens to a chat and the only one the
+ * transcript records without the UI ever saying so: a session silently loses most of
+ * its history, the next turn's prefix collapses, and the only visible trace is a long
+ * summary message. This reads the figures back out so the divider above that summary
+ * can state them.
+ *
+ * The link between a boundary and the message it introduces is `parentUuid`. Claude
+ * Code writes the `compact_boundary` record with `parentUuid: null` — it is the root
+ * of the post-compaction segment — and the summary immediately after it carries the
+ * boundary's uuid as its parent. Keying the result by that summary's uuid is what
+ * lets both message readers stamp it on without either of them knowing the layout,
+ * since `parseSessionMessage` already uses the record uuid as `ChatMessage.id`.
+ */
+
+import { existsSync } from "node:fs";
+import type { CompactionInfo } from "../types/chat.ts";
+import { readLines } from "./read-lines.ts";
+
+/**
+ * Cheap test for the only two lines per compaction worth parsing.
+ *
+ * A transcript reaches tens of megabytes and `JSON.parse` on every line of one is the
+ * dominant cost of reading it at all — but a compaction leaves two records in a file
+ * that holds thousands, so a substring check keeps this a scan rather than a parse.
+ */
+const BOUNDARY_MARKER = '"compact_boundary"';
+
+/**
+ * Map of compact-summary message uuid → that compaction's figures.
+ *
+ * Answers an empty map for a missing or unreadable file: a transcript that cannot be
+ * read still has messages worth showing, and a divider is not worth failing a history
+ * load over.
+ */
+export async function readCompactions(jsonlPath: string): Promise<Map<string, CompactionInfo>> {
+  const byMessageId = new Map<string, CompactionInfo>();
+  if (!existsSync(jsonlPath)) return byMessageId;
+
+  // The boundary is read one line before the summary that claims it, so it waits here
+  // until a record names it as parent. Held rather than assumed adjacent: the pairing
+  // is by uuid, so a record written between the two cannot mis-attach the figures.
+  let pending: { uuid: string; info: CompactionInfo } | null = null;
+
+  try {
+    for await (const line of readLines(jsonlPath)) {
+      if (line.includes(BOUNDARY_MARKER)) {
+        const info = parseBoundary(line);
+        pending = info ? { uuid: info.uuid, info: info.compaction } : null;
+        continue;
+      }
+      if (!pending) continue;
+      // Only lines that could be the child are parsed — the uuid of the boundary is a
+      // full uuid, so this substring test has no realistic false positive.
+      if (!line.includes(pending.uuid)) continue;
+      const child = parseChild(line);
+      if (child?.parentUuid === pending.uuid) {
+        byMessageId.set(child.uuid, pending.info);
+        pending = null;
+      }
+    }
+  } catch {
+    // Truncated or mid-write — keep whatever pairs were already complete.
+  }
+  return byMessageId;
+}
+
+/** The boundary's own uuid and figures, or null when the record is not one we can use. */
+function parseBoundary(line: string): { uuid: string; compaction: CompactionInfo } | null {
+  let entry: any;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (entry?.type !== "system" || entry.subtype !== "compact_boundary") return null;
+  const meta = entry.compactMetadata;
+  if (typeof entry.uuid !== "string" || !meta) return null;
+
+  const preTokens = numberOr(meta.preTokens, 0);
+  const postTokens = numberOr(meta.postTokens, 0);
+  // A boundary with no `preTokens` is a record shape this cannot describe — a zero
+  // saving would render as a confident "saved 0", which is worse than no divider.
+  if (preTokens <= 0) return null;
+
+  return {
+    uuid: entry.uuid,
+    compaction: {
+      trigger: meta.trigger === "manual" ? "manual" : "auto",
+      preTokens,
+      postTokens,
+      // Clamped: `postTokens` is absent on older records, and a summary that somehow
+      // measured larger than its input must not report a negative saving.
+      savedTokens: Math.max(0, preTokens - postTokens),
+      ...(typeof meta.durationMs === "number" ? { durationMs: meta.durationMs } : {}),
+    },
+  };
+}
+
+/** The uuid/parentUuid pair of a candidate child record. */
+function parseChild(line: string): { uuid: string; parentUuid: string } | null {
+  try {
+    const entry = JSON.parse(line);
+    if (typeof entry?.uuid !== "string" || typeof entry.parentUuid !== "string") return null;
+    return { uuid: entry.uuid, parentUuid: entry.parentUuid };
+  } catch {
+    return null;
+  }
+}
+
+function numberOr(value: unknown, fallback: number): number {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+
+/** Stamp each compaction onto the message that opens its segment. */
+export function applyCompactions(
+  messages: { id: string; compaction?: CompactionInfo }[],
+  byMessageId: Map<string, CompactionInfo>,
+): void {
+  if (byMessageId.size === 0) return;
+  for (const msg of messages) {
+    const info = byMessageId.get(msg.id);
+    if (info) msg.compaction = info;
+  }
+}

package/src/services/db.service.ts

@@ -8,7 +8,7 @@ import { backupDbSync } from "./db-backup/db-backup-sync.ts";
 import { CODEX_DEFAULT_MODEL } from "../types/config.ts";
 // Must equal the last `PRAGMA user_version` below: the pre-migration snapshot is skipped for
 // any database already at this version, so a stale value silently drops that backup.
-export const CURRENT_SCHEMA_VERSION = 51;
+export const CURRENT_SCHEMA_VERSION = 54;
 
 let db: Database | null = null;
 let dbProfile: string | null = null;
@@ -36,8 +36,7 @@ export function getDb(): Database {
   const ppmDir = getPpmDir();
   if (!existsSync(ppmDir)) mkdirSync(ppmDir, { recursive: true });
   db = new Database(getDbPath());
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA foreign_keys = ON");
+  applyDbPragmas(db);
   backupBeforeMigrations(db);
   runMigrations(db);
   return db;
@@ -68,6 +67,26 @@ function backupBeforeMigrations(database: Database): void {
   }
 }
 
+/**
+ * The pragmas every PPM connection to this database needs.
+ *
+ * `busy_timeout` is the one with a story. SQLite's default is to fail a
+ * contended lock INSTANTLY — measured, 0ms to `SQLiteError: database is
+ * locked` — and PPM routinely has two processes on this file for a moment: a
+ * `systemctl restart` starts the new supervisor while the outgoing server is
+ * still committing and checkpointing, which for a 300MB database is over a
+ * second. That single throw arrived as an unhandled rejection inside
+ * supervisor startup, which then stopped before spawning the edge forwarder —
+ * so PPM ran with nothing listening on its public port. 5s rather than the
+ * query audit's 2s: one snapshot of this database measures ~1.2s, so the wait
+ * has to cover a checkpoint plus whatever writes queued behind it.
+ */
+export function applyDbPragmas(database: Database): void {
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA busy_timeout = 5000");
+  database.exec("PRAGMA foreign_keys = ON");
+}
+
 /** Close the DB (for graceful shutdown or tests) */
 export function closeDb(): void {
   if (db) { db.close(); db = null; }
@@ -76,8 +95,7 @@ export function closeDb(): void {
 /** For tests: open an isolated in-memory DB with schema applied */
 export function openTestDb(): Database {
   const testDb = new Database(":memory:");
-  testDb.exec("PRAGMA journal_mode = WAL");
-  testDb.exec("PRAGMA foreign_keys = ON");
+  applyDbPragmas(testDb);
   runMigrations(testDb);
   return testDb;
 }
@@ -1131,10 +1149,33 @@ export function runMigrations(database: Database): void {
     database.exec(`PRAGMA user_version = 48;`);
   }
 
+  // This checkout's prompt-cache work first shipped as migrations 46-48 on turn_usage, before
+  // main used those numbers for accounts (it is 50-52 below now). A database that ran the local
+  // ones sits past 45 without main's columns, so the version gates above skip them for good and
+  // 49 then updates a column that does not exist. Added by schema rather than by version here;
+  // on a database that followed main every statement is a no-op.
+  if (current >= 46 && current < 49) {
+    for (const col of [
+      "granted_at INTEGER",
+      "refresh_expires_at INTEGER",
+      "reauth_required INTEGER NOT NULL DEFAULT 0",
+      "last_refresh_attempt_at INTEGER",
+    ]) {
+      try { database.exec(`ALTER TABLE accounts ADD COLUMN ${col}`); } catch { /* exists */ }
+    }
+    try { database.exec(`ALTER TABLE codex_accounts ADD COLUMN status TEXT NOT NULL DEFAULT 'active'`); } catch { /* exists */ }
+    try { database.exec(`ALTER TABLE codex_accounts ADD COLUMN daily_guard_enabled INTEGER NOT NULL DEFAULT 0`); } catch { /* exists */ }
+  }
+
   if (current < 49) {
     // Daily guard was introduced as an opt-in during development. Ship it enabled so every
     // weekly-only account starts paced; Plus accounts simply do not surface or use it.
-    database.exec(`UPDATE codex_accounts SET daily_guard_enabled = 1`);
+    //
+    // Guarded like every statement around it, and for the same reason: the ladder runs against
+    // databases that do not have this table yet. Unguarded, the throw escapes `runMigrations`
+    // and leaves the database half-migrated at whatever version the previous step wrote —
+    // there is no transaction around the ladder to undo it.
+    try { database.exec(`UPDATE codex_accounts SET daily_guard_enabled = 1`); } catch { /* no accounts table yet */ }
     database.exec(`PRAGMA user_version = 49;`);
   }
 
@@ -1155,6 +1196,33 @@ export function runMigrations(database: Database): void {
     try { database.exec("ALTER TABLE claude_limit_snapshots ADD COLUMN extra_json TEXT"); } catch { /* exists */ }
     database.exec(`PRAGMA user_version = 51;`);
   }
+
+  if (current < 52) {
+    // The idle-cache notice had to live entirely in server memory, because nothing on disk
+    // said when a session last cached or how much. `recorded_at` answers the first; this
+    // column answers the second with a figure the summed token columns cannot give —
+    // see `TurnUsage.contextTokens`. Null on every existing row: unmeasured, not zero.
+    try { database.exec("ALTER TABLE turn_usage ADD COLUMN context_tokens INTEGER"); } catch { /* column exists */ }
+    database.exec(`PRAGMA user_version = 52;`);
+  }
+
+  if (current < 53) {
+    // The cache window was inferred from the credential's shape — an `sk-ant-oat` prefix
+    // meaning a subscription and therefore an hour. The API states it outright in
+    // `usage.cache_creation`, and that answer has to outlive the process the way the rest of
+    // the last turn's facts now do. Null on existing rows: unreported, so the guess stands.
+    try { database.exec("ALTER TABLE turn_usage ADD COLUMN cache_ttl_ms INTEGER"); } catch { /* column exists */ }
+    database.exec(`PRAGMA user_version = 53;`);
+  }
+
+  if (current < 54) {
+    // A compaction makes the cached prefix inapplicable rather than stale, and the window in
+    // which that matters is between the compaction and the user's next message — a window a
+    // restart lands inside often enough to be worth surviving. Null on existing rows: no
+    // compaction is known, which is what every turn before this recorded anyway.
+    try { database.exec("ALTER TABLE turn_usage ADD COLUMN compacted_at INTEGER"); } catch { /* column exists */ }
+    database.exec(`PRAGMA user_version = 54;`);
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -1729,6 +1797,9 @@ export interface TurnUsageRow {
   cold_reason: string | null;
   account_id: string | null;
   account_label: string | null;
+  context_tokens: number | null;
+  cache_ttl_ms: number | null;
+  compacted_at: number | null;
   recorded_at: string;
 }
 
@@ -1745,13 +1816,16 @@ export function insertTurnUsage(record: {
   coldReason?: string;
   accountId?: string;
   accountLabel?: string;
+  contextTokens?: number;
+  cacheTtlMs?: number;
+  compactedAt?: number;
 }): void {
   getDb().query(
     `INSERT INTO turn_usage
        (session_id, model, input_tokens, output_tokens, cache_read_tokens,
         cache_write_tokens, context_window, cost_usd, cold_start, cold_reason,
-        account_id, account_label)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        account_id, account_label, context_tokens, cache_ttl_ms, compacted_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     record.sessionId, record.model ?? null,
     record.inputTokens, record.outputTokens,
@@ -1759,9 +1833,50 @@ export function insertTurnUsage(record: {
     record.contextWindow ?? null, record.costUsd ?? null,
     record.coldStart ? 1 : 0, record.coldReason ?? null,
     record.accountId ?? null, record.accountLabel ?? null,
+    record.contextTokens ?? null, record.cacheTtlMs ?? null, record.compactedAt ?? null,
   );
 }
 
+/**
+ * When this session last wrote its prompt cache, and what it would cost to write again.
+ *
+ * The idle notice used to be answerable only from the live `SessionEntry`, which is dropped
+ * five minutes after the last tab disconnects — while the cache it describes lives for an
+ * hour. So the notice appeared only for a session left connected and went silent for exactly
+ * the session reopened the next morning, which is the one it exists for. These three columns
+ * are already written on every turn; reading them back is the whole fix.
+ */
+export function getLastTurnCacheState(sessionId: string): {
+  endedAtMs: number;
+  prefixTokens: number;
+  contextTokens?: number;
+  cacheTtlMs?: number;
+  compactedAt?: number;
+} | null {
+  const row = getDb().query(
+    `SELECT input_tokens, cache_read_tokens, cache_write_tokens, context_tokens, cache_ttl_ms, compacted_at, recorded_at
+       FROM turn_usage WHERE session_id = ? ORDER BY id DESC LIMIT 1`,
+  ).get(sessionId) as Pick<
+    TurnUsageRow,
+    "input_tokens" | "cache_read_tokens" | "cache_write_tokens" | "context_tokens" | "cache_ttl_ms" | "compacted_at" | "recorded_at"
+  > | null;
+  if (!row?.recorded_at) return null;
+
+  // `datetime('now')` is UTC and writes no zone suffix, which `Date` then reads as LOCAL
+  // time — seven hours adrift in Asia/Saigon, enough to make the idle window come out
+  // negative and silence the notice on precisely the machines it was rebuilt for.
+  const endedAtMs = Date.parse(`${row.recorded_at.replace(" ", "T")}Z`);
+  if (!Number.isFinite(endedAtMs)) return null;
+
+  return {
+    endedAtMs,
+    prefixTokens: row.input_tokens + row.cache_read_tokens + row.cache_write_tokens,
+    ...(row.context_tokens != null && { contextTokens: row.context_tokens }),
+    ...(row.cache_ttl_ms != null && { cacheTtlMs: row.cache_ttl_ms }),
+    ...(row.compacted_at != null && { compactedAt: row.compacted_at }),
+  };
+}
+
 /** Most recent turns first — the debug dialog shows the tail of a session. */
 export function listTurnUsage(sessionId: string, limit = 30): TurnUsageRow[] {
   return getDb().query(