@indigoai-us/hq-cli 5.345.202 → 5.345.204

package/dist/lib/capacity/collectors/claude-oauth.js

@@ -36,6 +36,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { DIR_MODE, FILE_MODE, appendReadings, capacityRoot, EXPIRED_REASON, SIGN_IN_REVOKED_REASON, readCollectorMark, redactProviderTokens, } from "../ledger.js";
 import { hashClaudeAccountId } from "./claude-statusline.js";
+import { REMOTE_LANE_READ_ENV } from "../../lanes/outpost-dispatch.js";
 export const CLAUDE_OAUTH_PARSER_VERSION = "claude-oauth-usage.1";
 export const CLAUDE_OAUTH_PROVIDER = "claude";
 export const CLAUDE_OAUTH_SOURCE = "oauth-usage";
@@ -136,7 +137,11 @@ export function mapClaudeOAuthUsage(body, options) {
     }
     return { readings, failures };
 }
-export async function collectClaudeOAuth(options = {}) {
+export async function collectClaudeOAuth(inputOptions = {}) {
+    const options = {
+        ...inputOptions,
+        listLiveLanes: memoizeListLiveLanes(inputOptions.listLiveLanes ?? defaultListLiveLanes),
+    };
     const ledger = ledgerOptions(options);
     const root = ledger.root ?? capacityRoot(ledger.env, ledger.home);
     const scoped = { ...ledger, root };
@@ -1766,43 +1771,62 @@ export function resolveHqInvocation(argv = process.argv, execPath = process.exec
 }
 /** Output cap for the `hq ... --json` reads behind the refresh gates. */
 const HQ_JSON_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
-const HQ_JSON_TIMEOUT_MS = 15_000;
-/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+const HQ_JSON_TIMEOUT_MS = 30_000;
+/**
+ * Run `hq ... --json` and parse stdout. Async on purpose: the collector runs inside the mesh
+ * daemon, and a synchronous read that takes 15-30 s on a loaded machine froze the daemon's
+ * event loop (MQTT keepalive, owner heartbeat) for the whole read.
+ * Exported for tests; `invocation` defaults to {@link resolveHqInvocation}.
+ */
 export function execHqJson(args, invocation = resolveHqInvocation(), env = process.env) {
-    const result = spawnSync(invocation.command, [...invocation.args, ...args], {
-        env,
-        encoding: "utf8",
-        // The lane list takes ~2.5 s on a busy machine and grows with lane history; 5 s left too
-        // little headroom under load, and a timeout fails the gate closed.
-        timeout: HQ_JSON_TIMEOUT_MS,
-        // `hq lanes list --json` grows with lane history (1.7 MB on a busy machine). The spawnSync
-        // default of 1 MiB raised ENOBUFS, which made the live-lane gate fail closed on every collect.
-        maxBuffer: HQ_JSON_MAX_BUFFER_BYTES,
-        windowsHide: true,
-        stdio: ["ignore", "pipe", "pipe"],
+    const label = `hq ${args.join(" ")}`;
+    return new Promise((resolve, reject) => {
+        execFile(invocation.command, [...invocation.args, ...args], {
+            env,
+            encoding: "utf8",
+            // The lane list takes ~2.5 s on an idle machine and grows with lane history. Under heavy
+            // load (load average ~95 on 18 cores) the same read took 16-18 s, so 15 s still failed the
+            // gate closed on every collect and every Claude home stayed expired.
+            timeout: HQ_JSON_TIMEOUT_MS,
+            // `hq lanes list --json` grows with lane history (6.8 MB on a busy machine). The 1 MiB
+            // default made the live-lane gate fail closed on every collect.
+            maxBuffer: HQ_JSON_MAX_BUFFER_BYTES,
+            // SIGTERM can be trapped, and execFile waits for the child to exit before calling back.
+            killSignal: "SIGKILL",
+            windowsHide: true,
+        }, (error, stdout) => {
+            if (error) {
+                const failure = error;
+                const code = failure.code;
+                if (code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
+                    reject(new Error(`${label} output exceeded ${HQ_JSON_MAX_BUFFER_BYTES} bytes`));
+                }
+                else if (failure.killed) {
+                    reject(new Error(`${label} timed out`));
+                }
+                else if (typeof code === "number") {
+                    reject(new Error(`${label} exit ${code}`));
+                }
+                else if (failure.signal) {
+                    reject(new Error(`${label} killed by ${failure.signal}`));
+                }
+                else {
+                    reject(new Error(`${label} failed to spawn: ${failure.message}`));
+                }
+                return;
+            }
+            if (!stdout) {
+                reject(new Error(`${label} empty stdout`));
+                return;
+            }
+            try {
+                resolve(JSON.parse(stdout));
+            }
+            catch (parseError) {
+                reject(new Error(`${label} invalid JSON: ${parseError.message}`));
+            }
+        });
     });
-    if (result.error) {
-        const code = result.error.code;
-        if (code === "ETIMEDOUT")
-            throw new Error(`hq ${args.join(" ")} timed out`);
-        if (code === "ENOBUFS")
-            throw new Error(`hq ${args.join(" ")} output exceeded ${HQ_JSON_MAX_BUFFER_BYTES} bytes`);
-        throw new Error(`hq ${args.join(" ")} failed to spawn: ${result.error.message}`);
-    }
-    if (result.signal)
-        throw new Error(`hq ${args.join(" ")} killed by ${result.signal}`);
-    if (typeof result.status !== "number")
-        throw new Error(`hq ${args.join(" ")} no exit status`);
-    if (result.status !== 0)
-        throw new Error(`hq ${args.join(" ")} exit ${result.status}`);
-    if (!result.stdout)
-        throw new Error(`hq ${args.join(" ")} empty stdout`);
-    try {
-        return JSON.parse(result.stdout);
-    }
-    catch (error) {
-        throw new Error(`hq ${args.join(" ")} invalid JSON: ${error.message}`);
-    }
 }
 /**
  * Parse `hq lanes list --json` payload into typed rows.
@@ -1889,12 +1913,31 @@ export function buildLiveLanesFromPayloads(lanes, accounts) {
  * Throws on hq call failure or unexpected JSON shape; callers skip the refresh.
  */
 const defaultListLiveLanes = async () => {
-    const lanesPayload = execHqJson(["lanes", "list", "--json"]);
-    const accountsPayload = execHqJson(["lanes", "accounts", "list", "--json"]);
+    // The gate only needs lanes that use this host's Claude homes. Skip the Outpost mirror
+    // refresh (a network round trip per Outpost); cached mirror rows are still listed.
+    const env = { ...process.env, [REMOTE_LANE_READ_ENV]: "1" };
+    const invocation = resolveHqInvocation();
+    const [lanesPayload, accountsPayload] = await Promise.all([
+        execHqJson(["lanes", "list", "--json"], invocation, env),
+        execHqJson(["lanes", "accounts", "list", "--json"], invocation, env),
+    ]);
     const lanes = parseLanesListPayload(lanesPayload);
     const accounts = parseAccountsListPayload(accountsPayload);
     return buildLiveLanesFromPayloads(lanes, accounts);
 };
+/**
+ * Share one lane read across every home in a collect. Without this each expired home ran its
+ * own pair of `hq lanes ... --json` reads, so one slow machine turned into N timeouts per
+ * collect. A failure is shared too: the next home fails closed without waiting again.
+ * Exported for tests.
+ */
+export function memoizeListLiveLanes(list) {
+    let pending = null;
+    return () => {
+        pending ??= list();
+        return pending;
+    };
+}
 /**
  * Parse `ps -axo pid=,command=` into rows that mention the `claude` executable.
  * Exported for tests. Returned rows carry `probe: "command-only"` so the gate
@@ -1926,14 +1969,145 @@ export function parsePsClaudeOutput(stdout) {
     }
     return out;
 }
+/** Pid to full command line, from `ps -ww -o pid=,command= -p <pids>`. Exported for tests. */
+export function parsePsCommandLines(stdout) {
+    const lines = new Map();
+    for (const rawLine of stdout.split("\n")) {
+        const match = /^\s*(\d+) (.*)$/.exec(rawLine.replace(/\s+$/, ""));
+        if (match)
+            lines.set(Number(match[1]), match[2]);
+    }
+    return lines;
+}
+/**
+ * Upgrade darwin command-only rows with each process's environment. `ps -wwE` prints a
+ * same-user process's command line followed by its environment, unquoted and space separated.
+ * Only the text after the exact command line (read separately with `ps -ww`) is treated as the
+ * environment, so a prompt argument that mentions CLAUDE_CONFIG_DIR= or HOME= is never read as
+ * env. A row becomes `probe: "env"` only when:
+ *   - the `-E` line starts with the command line plus a space, and the rest starts with NAME=;
+ *   - CLAUDE_CONFIG_DIR= appears at most once in that rest, and its value is absolute and
+ *     names an existing directory (the value runs to the next ` NAME=` or the end of line).
+ * Anything else stays command-only, which blocks every home. A pid missing from the output
+ * is dropped only when it is known to have exited; otherwise it stays command-only.
+ * Exported for tests.
+ */
+export function parsePsEnvOutput(envStdout, commandLines, rows, options = {}) {
+    const isDirectory = options.isDirectory ?? defaultIsDirectory;
+    const isAlive = options.isAlive ?? defaultIsAlive;
+    const envLines = parsePsCommandLines(envStdout);
+    const blocked = (pid) => ({ pid, env: {}, probe: "command-only" });
+    const out = [];
+    for (const row of rows) {
+        const command = commandLines.get(row.pid);
+        const line = envLines.get(row.pid);
+        if (command === undefined || line === undefined) {
+            if (isAlive(row.pid))
+                out.push(blocked(row.pid));
+            continue;
+        }
+        if (!line.startsWith(`${command} `)) {
+            // No visible env (another user's or a protected process), or the pid was reused.
+            out.push(blocked(row.pid));
+            continue;
+        }
+        const env = line.slice(command.length + 1);
+        if (!/^[A-Za-z_][A-Za-z0-9_]*=/.test(env)) {
+            out.push(blocked(row.pid));
+            continue;
+        }
+        const mentions = env.split("CLAUDE_CONFIG_DIR=").length - 1;
+        const match = /(?:^| )CLAUDE_CONFIG_DIR=(.*?)(?= [A-Za-z_][A-Za-z0-9_]*=|$)/.exec(env);
+        if (mentions === 0) {
+            // The default config dir is HOME/.claude for this process. HOME must be one absolute
+            // value; an unset HOME falls back to the collector's own home.
+            const homes = [...env.matchAll(/(?:^| )HOME=(.*?)(?= [A-Za-z_][A-Za-z0-9_]*=|$)/g)].map((m) => m[1]);
+            if (homes.length === 0) {
+                out.push({ pid: row.pid, env: {}, probe: "env" });
+            }
+            else if (homes.length === 1 && path.isAbsolute(homes[0])) {
+                out.push({ pid: row.pid, env: { HOME: homes[0] }, probe: "env" });
+            }
+            else {
+                out.push(blocked(row.pid));
+            }
+        }
+        else if (mentions === 1 && match && path.isAbsolute(match[1]) && isDirectory(match[1])) {
+            out.push({ pid: row.pid, env: { CLAUDE_CONFIG_DIR: match[1] }, probe: "env" });
+        }
+        else {
+            out.push(blocked(row.pid));
+        }
+    }
+    return out;
+}
+/** Default config dir of an env-probed process with CLAUDE_CONFIG_DIR unset. Exported for tests. */
+export function processDefaultConfigDir(proc) {
+    const home = typeof proc.env.HOME === "string" && path.isAbsolute(proc.env.HOME) ? proc.env.HOME : os.homedir();
+    return path.join(home, ".claude");
+}
+function defaultIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== "ESRCH";
+    }
+}
+/**
+ * Canonical form of a home directory for comparison: symlinks resolved by the OS, and lower
+ * case on darwin, where APFS is case-insensitive by default. Null when the path cannot be
+ * resolved. Exported for tests.
+ */
+export function canonicalHomePath(dir, platform = process.platform) {
+    try {
+        const real = fs.realpathSync.native(path.resolve(dir));
+        return platform === "darwin" ? real.toLowerCase() : real;
+    }
+    catch {
+        return null;
+    }
+}
+function defaultIsDirectory(dir) {
+    try {
+        return fs.statSync(dir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function runPs(args) {
+    const result = spawnSync("ps", [...args], {
+        encoding: "utf8",
+        timeout: 5_000,
+        // Full command lines for every process can pass the 1 MiB default on a busy machine.
+        maxBuffer: HQ_JSON_MAX_BUFFER_BYTES,
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.error)
+        throw new Error(`ps failed to spawn: ${result.error.message}`);
+    if (result.signal)
+        throw new Error(`ps killed by ${result.signal}`);
+    if (typeof result.status !== "number")
+        throw new Error("ps no exit status");
+    // `ps -p` exits 1 both when no pid still exists and on a real error. Accept exit 1 only with
+    // empty stderr; parsePsEnvOutput then keeps any pid that is not known to be gone as blocking.
+    const quietNoMatch = args.includes("-p") && result.status === 1 && !(result.stderr ?? "").trim();
+    if (result.status !== 0 && !quietNoMatch)
+        throw new Error(`ps exit ${result.status}`);
+    return result.stdout ?? "";
+}
 /**
  * Fail-closed enumeration of running Claude Code processes.
  *
  * linux: /proc/<pid>/environ gives us per-process CLAUDE_CONFIG_DIR; absent
  *   value means the process holds the default home.
- * darwin: ps cannot read a child process environment, so we return
- *   `probe: "command-only"` rows. The gate treats such a row as holding the
- *   default home AND blocking every non-default home.
+ * darwin: `ps -axo` finds claude processes, then `ps -wwE` reads their
+ *   environment (same user only). Rows whose environment cannot be read stay
+ *   `probe: "command-only"`; the gate treats such a row as holding the default
+ *   home AND blocking every non-default home.
  * other platforms: return []. The lane gate is authoritative there.
  *
  * Throws on ps/readdir failure so the caller skips refresh.
@@ -1975,32 +2149,23 @@ const defaultListProcesses = async () => {
                 throw new Error(`read /proc/${entry}/environ failed`);
             }
             const match = /(?:^|\0)CLAUDE_CONFIG_DIR=([^\0]+)/.exec(envText);
-            out.push({
-                pid,
-                env: match && match[1] ? { CLAUDE_CONFIG_DIR: match[1] } : {},
-                probe: "env",
-            });
+            const homeMatch = /(?:^|\0)HOME=([^\0]+)/.exec(envText);
+            const procEnv = {};
+            if (match && match[1])
+                procEnv.CLAUDE_CONFIG_DIR = match[1];
+            if (homeMatch && homeMatch[1])
+                procEnv.HOME = homeMatch[1];
+            out.push({ pid, env: procEnv, probe: "env" });
         }
         return out;
     }
     if (process.platform === "darwin") {
-        const result = spawnSync("ps", ["-axo", "pid=,command="], {
-            encoding: "utf8",
-            timeout: 5_000,
-            // Full command lines for every process can pass the 1 MiB default on a busy machine.
-            maxBuffer: HQ_JSON_MAX_BUFFER_BYTES,
-            windowsHide: true,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        if (result.error)
-            throw new Error(`ps failed to spawn: ${result.error.message}`);
-        if (result.signal)
-            throw new Error(`ps killed by ${result.signal}`);
-        if (typeof result.status !== "number")
-            throw new Error("ps no exit status");
-        if (result.status !== 0)
-            throw new Error(`ps exit ${result.status}`);
-        return parsePsClaudeOutput(result.stdout ?? "");
+        const rows = parsePsClaudeOutput(runPs(["-axo", "pid=,command="]));
+        if (rows.length === 0)
+            return rows;
+        const pids = rows.map((row) => String(row.pid)).join(",");
+        const commandLines = parsePsCommandLines(runPs(["-ww", "-o", "pid=,command=", "-p", pids]));
+        return parsePsEnvOutput(runPs(["-wwE", "-o", "pid=,command=", "-p", pids]), commandLines, rows);
     }
     return [];
 };
@@ -2027,7 +2192,16 @@ async function attemptClaudeTokenRefresh(ctx) {
         return { outcome: "skipped-live-check-failed", errorMessage: message };
     }
     const resolvedHome = path.resolve(ctx.home);
-    const sameHome = (candidate) => typeof candidate === "string" && candidate.length > 0 && path.resolve(candidate) === resolvedHome;
+    const targetHome = canonicalHomePath(ctx.home) ?? resolvedHome;
+    // Exact match, for the auth-failed short circuit, which records the home as revoked.
+    const sameHome = (candidate) => typeof candidate === "string" && candidate.length > 0 && canonicalHomePath(candidate) === targetHome;
+    // Blocking match: a path that cannot be resolved might be this home, so it blocks.
+    const mayHoldHome = (candidate) => {
+        if (typeof candidate !== "string" || candidate.length === 0)
+            return false;
+        const canonical = canonicalHomePath(candidate);
+        return canonical === null || canonical === targetHome;
+    };
     // Addendum 1: if the lane watcher classified a 401/403 on this home as
     // provider_auth_failed, treat the account as already signed out and record
     // revoked immediately. No token endpoint call, no response body stored.
@@ -2046,7 +2220,7 @@ async function attemptClaudeTokenRefresh(ctx) {
         });
         return { outcome: "revoked", errorClass: "revoked" };
     }
-    if (liveLanes.some((lane) => lane.isLive && sameHome(lane.home))) {
+    if (liveLanes.some((lane) => lane.isLive && mayHoldHome(lane.home))) {
         recordRefresh(ctx.root, key, { attemptedAt: new Date(ctx.nowMs).toISOString(), outcome: "skipped-live" });
         return { outcome: "skipped-live" };
     }
@@ -2065,15 +2239,21 @@ async function attemptClaudeTokenRefresh(ctx) {
         return { outcome: "skipped-process-check-failed", errorMessage: message };
     }
     const defaultHome = path.join(os.homedir(), ".claude");
-    const isDefaultHome = resolvedHome === path.resolve(defaultHome);
+    const isDefaultHome = targetHome === (canonicalHomePath(defaultHome) ?? path.resolve(defaultHome));
     const procBlocks = procs.some((proc) => {
         if (proc.probe === "env") {
             const dir = typeof proc.env.CLAUDE_CONFIG_DIR === "string" ? proc.env.CLAUDE_CONFIG_DIR : "";
-            // On linux we have a real env read. Default home is held when
-            // CLAUDE_CONFIG_DIR is empty; non-default home only when it points here.
-            if (!dir)
-                return isDefaultHome;
-            return path.resolve(dir) === resolvedHome;
+            // A real env read. With CLAUDE_CONFIG_DIR unset the process holds HOME/.claude for its
+            // own HOME (the collector's home when HOME was not read). Claude Code adds no keychain
+            // suffix without CLAUDE_CONFIG_DIR, so such a process may also use the default keychain
+            // item; it keeps blocking the collector's default home too.
+            // Compare the process's default dir the same way as the collector's: a dir that does not
+            // exist yet is compared by its resolved path, so a missing ~/.claude does not block every home.
+            if (!dir) {
+                const procDefault = processDefaultConfigDir(proc);
+                return isDefaultHome || targetHome === (canonicalHomePath(procDefault) ?? path.resolve(procDefault));
+            }
+            return mayHoldHome(dir);
         }
         // command-only (darwin): we cannot read the per-process env. Conservatively
         // treat the row as holding the default home AND blocking non-default homes.

package/dist/lib/capacity/ledger.d.ts

@@ -1,14 +1,3 @@
-/**
- * Personal capacity ledger under ~/.hq/capacity/.
- *
- * Daily files events-YYYY-MM-DD.jsonl are the append-only event log (one
- * O_APPEND write under 4 KB). rebuildNow() replays those files, plus a
- * legacy events.jsonl if a fixture dropped one, into now.json. The now.json
- * rewrite holds a TTL lock reclaimed after 30 seconds.
- *
- * Root is HQ_CAPACITY_ROOT, or an explicit option, so tests never touch the
- * real home directory. No network, child process, or provider call.
- */
 export declare const CAPACITY_DIRNAME = "capacity";
 export declare const CAPACITY_LOCK_TTL_MS = 30000;
 export declare const CAPACITY_LOCK_NAME = "now.lock";

package/dist/lib/capacity/ledger.js

@@ -1,3 +1,4 @@
+import { codexSnapshotStale, hasCodexCreditRoom } from "./codex-availability.js";
 /**
  * Personal capacity ledger under ~/.hq/capacity/.
  *
@@ -857,11 +858,26 @@ function materialize(events, ctx) {
             return a.reading.limit.limitId.localeCompare(b.reading.limit.limitId);
         })
             .map((limit) => toNowLimit(limit, ctx.nowMs));
+        if (provider === "codex") {
+            for (const limit of limits) {
+                if (codexSnapshotStale(limit, limits)) {
+                    limit.state = "unknown";
+                    limit.usedPercent = null;
+                    limit.burnRatePercentPerHour = null;
+                    limit.lastError = "superseded by a newer Codex snapshot";
+                }
+            }
+        }
         const failed = bucket.failure !== null && bucket.failure.at >= bucket.latestReadingAt;
         let state = "ok";
         for (const limit of limits) {
-            if (STATE_RANK[limit.state] > STATE_RANK[state])
-                state = limit.state;
+            if (provider === "codex" && codexSnapshotStale(limit, limits))
+                continue;
+            const availableState = provider === "codex" && limit.state === "exhausted"
+                && hasCodexCreditRoom(limits.filter((row) => row.accountId === limit.accountId), ctx.nowMs)
+                ? "ok" : limit.state;
+            if (STATE_RANK[availableState] > STATE_RANK[state])
+                state = availableState;
         }
         if (failed)
             state = "unknown";
@@ -878,6 +894,15 @@ function materialize(events, ctx) {
         }
         const unscopedFailure = bucket.failure !== null && bucket.failure.at >= bucket.latestReadingAt;
         attachAccounts(entry, events, unscopedFailure);
+        if (provider === "codex" && !failed && entry.accounts?.length) {
+            for (const account of entry.accounts) {
+                if (account.authState === "ok" && account.state === "exhausted"
+                    && hasCodexCreditRoom(account.limits, ctx.nowMs))
+                    account.state = "ok";
+            }
+            const live = entry.accounts.filter((account) => account.authState !== "expired" && account.authState !== "signed_out" && !account.signedOut);
+            entry.state = live.length === 0 ? "unknown" : live.reduce((state, account) => STATE_RANK[account.state] > STATE_RANK[state] ? account.state : state, "ok");
+        }
         return entry;
     });
     return {
@@ -1039,6 +1064,8 @@ function clusterAccounts(provider, events) {
         if (!blocked) {
             state = "ok";
             for (const limit of limits) {
+                if (provider.provider === "codex" && codexSnapshotStale(limit, limits))
+                    continue;
                 if (STATE_RANK[limit.state] > STATE_RANK[state])
                     state = limit.state;
             }
@@ -1182,7 +1209,7 @@ function deriveLimit(reading, nowMs) {
     // A passed reset beats both a refusal and a 100% reading. The newest
     // observedAt wins in materialize, so a later fetched or observed percent
     // below 100 replaces this refusal before the reset.
-    if (!Number.isNaN(resetsAtMs) && resetsAtMs < nowMs) {
+    if (!Number.isNaN(resetsAtMs) && resetsAtMs <= nowMs) {
         return { state: "reset-pending", usedPercent: null, secondsToReset: null, lastError: null };
     }
     const percent = reading.limit.usedPercent;

package/dist/lib/capacity/route.js

@@ -1,3 +1,4 @@
+import { codexSnapshotStale, hasCodexCreditRoom } from "./codex-availability.js";
 /**
  * Pure router for `hq capacity route` and `hq lanes create --account auto`.
  *
@@ -368,7 +369,7 @@ export function pickAccount(input) {
                 if (resetPassed) {
                     return { limit, used: 0, readAge, resetPassed: true };
                 }
-                if (readAge > LIMIT_STALE_MS) {
+                if (readAge > LIMIT_STALE_MS || (providerId === "codex" && codexSnapshotStale(limit, account.limits ?? []))) {
                     return { limit, used: null, readAge, resetPassed: false };
                 }
                 const used = typeof limit.usedPercent === "number" ? limit.usedPercent : null;
@@ -393,14 +394,18 @@ export function pickAccount(input) {
             }
             const exhausted = viewRows.find((row) => !row.resetPassed
                 && row.readAge <= LIMIT_STALE_MS
+                && !(providerId === "codex" && codexSnapshotStale(row.limit, account.limits ?? []))
                 && (row.limit.state === "exhausted" || (typeof row.used === "number" && row.used >= 100)));
             if (exhausted) {
+                const codexCredits = providerId === "codex" && hasCodexCreditRoom(account.limits ?? [], nowMs);
                 const extraRoom = providerId === "claude" && hasExtraUsageRoom(account);
-                if (extraRoom && input.allowExtraUsage === true) {
+                if (codexCredits || (extraRoom && input.allowExtraUsage === true)) {
                     const live = liveLaneCount(lanes, providerId, laneMatch.id);
                     const weekly = applicable.find((l) => l.kind === "weekly_all");
                     const whyParts = [
-                        `${labelLimit(exhausted.limit)} used up; runs on paid extra usage (--allow-extra-usage)`,
+                        codexCredits
+                            ? `${labelLimit(exhausted.limit)} used up; runs on available Codex credits`
+                            : `${labelLimit(exhausted.limit)} used up; runs on paid extra usage (--allow-extra-usage)`,
                     ];
                     if (live)
                         whyParts.push(`${live} live lane${live === 1 ? "" : "s"} already on it`);
@@ -515,7 +520,8 @@ export function pickAccount(input) {
             });
         }
     }
-    ranked.sort((a, b) => b.score - a.score
+    ranked.sort((a, b) => Number(a.extra_usage === true) - Number(b.extra_usage === true)
+        || b.score - a.score
         || b.headroom - a.headroom
         || a.reading_age_h - b.reading_age_h
         || a.provider.localeCompare(b.provider));
@@ -524,7 +530,7 @@ export function pickAccount(input) {
         if (!requested.includes(p))
             continue;
         const best = ranked.find((r) => r.provider === p);
-        if (best && best.headroom >= floor) {
+        if (best && !best.extra_usage && best.headroom >= floor) {
             pick = best;
             break;
         }

package/dist/lib/daemon/catalog.d.ts

@@ -98,6 +98,9 @@ export declare const FLEET_BOTS_UPDATE_INITIAL_DELAY_SEC = 120;
 export declare const SYNC_CORE_RECONCILE_UNIT = "sync-core";
 export declare const SYNC_CORE_RECONCILE_INTERVAL_SEC = 600;
 export declare const SYNC_CORE_MANIFEST_UNIT = "sync-core-manifest";
+export declare const SYNC_CORE_SELFCHECK_UNIT = "sync-core-selfcheck";
+/** The self-check looks hourly; it DMs the owner at most once a day for the same units (selfcheck.ts). */
+export declare const SYNC_CORE_SELFCHECK_INTERVAL_SEC = 3600;
 export declare const SYNC_CORE_MANIFEST_INTERVAL_SEC: number;
 export declare const SYNC_CORE_LEGACY_SETTLE_MS: number;
 export interface PlanContext {

package/dist/lib/daemon/catalog.js

@@ -98,6 +98,9 @@ export const FLEET_BOTS_UPDATE_INITIAL_DELAY_SEC = 120;
 export const SYNC_CORE_RECONCILE_UNIT = "sync-core";
 export const SYNC_CORE_RECONCILE_INTERVAL_SEC = 600;
 export const SYNC_CORE_MANIFEST_UNIT = "sync-core-manifest";
+export const SYNC_CORE_SELFCHECK_UNIT = "sync-core-selfcheck";
+/** The self-check looks hourly; it DMs the owner at most once a day for the same units (selfcheck.ts). */
+export const SYNC_CORE_SELFCHECK_INTERVAL_SEC = 3600;
 export const SYNC_CORE_MANIFEST_INTERVAL_SEC = 24 * 3600;
 export const SYNC_CORE_LEGACY_SETTLE_MS = 10 * 60 * 1000;
 function base(service, over = {}) {
@@ -208,8 +211,8 @@ function planService(service, ctx) {
             return [unit];
         }
         case "sync-core": {
-            if (ctx.platform !== "darwin" && ctx.platform !== "linux") {
-                return [unavailable(service, "the new sync engine runs on macOS and Linux only")];
+            if (ctx.platform !== "darwin" && ctx.platform !== "linux" && ctx.platform !== "win32") {
+                return [unavailable(service, "the new sync engine runs on macOS, Linux and Windows only")];
             }
             const reconcile = base(service, {
                 id: SYNC_CORE_RECONCILE_UNIT,
@@ -265,9 +268,19 @@ function planService(service, ctx) {
                     ]),
                 });
             });
+            const selfcheck = engines.length === 0 ? [] : [base(service, {
+                    id: SYNC_CORE_SELFCHECK_UNIT,
+                    description: "tells the signed-in person by DM when a sync engine unit has been held or failing for over 30 minutes",
+                    kind: "scheduled",
+                    intervalSec: SYNC_CORE_SELFCHECK_INTERVAL_SEC,
+                    initialDelaySec: 35 * 60,
+                    command: { type: "hq", args: ["daemon", "service", "sync-core-selfcheck"] },
+                    env: { HQ_NO_UPDATE_CHECK: "1" },
+                    blocked: firstBlock([[!ctx.signedIn, NOT_SIGNED_IN]]),
+                })];
             const manifestScopes = engineOwnedManifestScopes(ctx.vaultSync, ctx.syncCoreVaults);
             if (manifestScopes.length === 0)
-                return [reconcile, ...engines];
+                return [reconcile, ...engines, ...selfcheck];
             const manifest = base(service, {
                 id: SYNC_CORE_MANIFEST_UNIT,
                 description: `uploads a daily sync-audit manifest for ${manifestScopes.map((scope) => scope.kind === "personal" ? "the personal vault" : `the ${scope.slug} vault`).join(", ")}`,
@@ -286,7 +299,7 @@ function planService(service, ctx) {
                     [!ctx.signedIn, NOT_SIGNED_IN],
                 ]),
             });
-            return [reconcile, ...engines, manifest];
+            return [reconcile, ...engines, manifest, ...selfcheck];
         }
         case "mesh": {
             const args = ["mesh", "daemon", "run", ...(ctx.hqRoot ? ["--hq-root", ctx.hqRoot] : [])];

package/dist/lib/daemon/handoff.d.ts

@@ -7,6 +7,8 @@
 import { type ServiceName } from "./catalog.js";
 import { type MachineType } from "./machine-type.js";
 import { type DaemonPaths } from "./paths.js";
+/** The updater's postinstall may run in the short gap before the desktop app relaunches its daemon. */
+export declare function recentlyHostedDaemon(paths: DaemonPaths, alive?: (pid: number) => boolean): boolean;
 /** A live daemon runs `unitId` (or held it after it was stopped from outside). */
 export declare function daemonSupervises(paths: DaemonPaths, unitId: string, alive?: (pid: number) => boolean): boolean;
 /** Current supervisor hold, including its explicit recovery command; never infer one from stale state. */

package/dist/lib/daemon/handoff.js

@@ -20,10 +20,14 @@ import { writeControlRequest } from "./requests.js";
 const OWNED = new Set(["running", "backoff", "exited", "idle", "stopped", "held"]);
 const RECENT_HOSTED_DAEMON_MS = 5 * 60_000;
 /** The updater's postinstall may run in the short gap before the desktop app relaunches its daemon. */
-function recentlyHostedDaemon(paths) {
+export function recentlyHostedDaemon(paths, alive = (pid) => isDaemonProcess(pid)) {
     if (!fs.existsSync(paths.statePath))
         return false;
     const state = JSON.parse(fs.readFileSync(paths.statePath, "utf8"));
+    // A different live daemon holds the lock: the hosted daemon that wrote this state is gone, not restarting.
+    const lockPid = runningDaemonPid(paths.lockPath, alive);
+    if (lockPid !== null && state.pid !== lockPid)
+        return false;
     const age = Date.now() - (state.updatedAt ?? 0);
     return state.host === "desktop" && age >= 0 && age <= RECENT_HOSTED_DAEMON_MS;
 }
@@ -85,7 +89,10 @@ export function askDaemonToStop(paths, unitId) {
 /** A live daemon runs as the desktop app's child, which counts as installed even though no OS unit exists. */
 export function hostedDaemonRunning(paths, alive = (pid) => isDaemonProcess(pid)) {
     try {
-        return liveState(paths, alive)?.host === "desktop";
+        // state.json outlives the daemon that wrote it: count it only when it is the lock holder's.
+        const lockPid = runningDaemonPid(paths.lockPath, alive);
+        const state = liveState(paths, alive);
+        return state?.host === "desktop" && state.pid === lockPid;
     }
     catch {
         return false;