@inetafrica/open-claudia 3.4.11 → 3.4.13

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 3.4.13
+
+- **Codex is now measured the way Claude is.** After each Codex turn the bot reads Codex's own per-request token log (`$CODEX_HOME/sessions/…/rollout-*-<thread>.jsonl`) and uses the last request's size as the live context, instead of the turn's input summed over every tool call. That sum (33M on one turn) tripped auto-compact after almost every substantial Codex turn — 8 needless compactions on 2026-09-05, each a summary run plus a cold restart — while Codex's real window occupancy never exceeded 245k of its 258k window. Codex sessions now compact at 80% of the window Codex reports.
+- **Codex usage was mis-recorded three ways; all fixed.** (1) `turn.completed` usage is per turn by Codex's own definition, but the ledger treated it as a running total and subtracted the previous turn — 9 of 36 Codex turns that day were logged as zero. (2) OpenAI counts cached tokens inside `input_tokens`; the ledger and `/usage` now report uncached input for both providers (the raw comparison read 89.7M vs 4.5k for what was really 2.4M vs 0.8M). (3) Sub-agent threads Codex spawns with `spawn_agent` never appeared anywhere: the day's ten hidden threads read ~240M tokens and took a weekly quota from 75% to 100% in two hours. They are now attributed to the parent turn (`subagentThreads`, `subagentInputTokens`, …) and shown by `/usage`.
+- **Quota and window visibility.** Ledger rows carry `contextWindowTokens`, `requests`, `providerCompactions` (Codex's own compactions) and the plan quota snapshot (`quotaUsedPercent`, `quotaResetsAt`); `/usage` prints window occupancy, sub-agent totals and quota used.
+
+## 3.4.12
+
+- Keep incoming calls on their per-attempt admission policy when the organization canary setting changes; managed access supplies the assigned gateway and TURN configuration. Owner-only audio calling remains enforced.
+- Flatten ICE server URLs for Werift, whose installed parser silently omits TURN when given browser-style URL arrays. Verify actual peer-connection TURN configuration in the tests.
+- Refresh Janus grants and relay credentials for future peer connections. Existing Werift TURN allocations keep their original credentials and expiry, so the bot closes before the earliest active allocation deadline. It does not hot-swap existing allocation authentication; the default one-hour TURN lifetime exceeds the bot's thirty-minute call limit.
+- Exclude the bot's own publisher by its Janus-assigned feed ID, including when the gateway replaces display names with canonical email. Keep the legacy bot display-prefix exclusion.
+
 ## 3.4.11
 
 - Verify timed-out guard processes from their parent, including forced termination and released concurrency, without racing a child-written receipt.

package/channels/kazee/call/access.js

@@ -1,12 +1,40 @@
 "use strict";
 const { randomUUID } = require("crypto");
 function validServer(value) {
-  if (value === undefined) return true;
+  if (value === undefined) return false;
   if (typeof value !== 'string') return false;
-  try { const url = new URL(value); return url.protocol === 'wss:' && !!url.hostname && !url.username && !url.password && !url.hash; }
+  try { const url = new URL(value); return url.protocol === 'wss:' && !!url.hostname && !url.username && !url.password && !url.hash && !url.search; }
   catch { return false; }
 }
 
+function projectAssignedIce(reply, now = Date.now()) {
+  if (!Array.isArray(reply.iceServers) || !reply.iceServers.length || reply.iceServers.length > 12
+    || !Number.isFinite(reply.iceCredentialsExpiresAt) || reply.iceCredentialsExpiresAt <= now) throw new Error("Invalid assigned call relay");
+  const iceServers = reply.iceServers.map(server => {
+    if (!server || typeof server !== 'object') throw new Error("Invalid assigned call relay");
+    const urls = Array.isArray(server.urls) ? server.urls : [server.urls];
+    if (!urls.length || urls.length > 12 || urls.some(url => typeof url !== 'string' || url.length > 1024
+      || !/^(stun|turn|turns):[^\s@?#]+(?:\?transport=(udp|tcp))?$/.test(url))) throw new Error("Invalid assigned call relay");
+    if (urls.some(url => /^turns?:/.test(url)) && (typeof server.username !== 'string' || !server.username || server.username.length > 2048
+      || typeof server.credential !== 'string' || !server.credential || server.credential.length > 2048)) throw new Error("Invalid assigned call relay");
+    return { urls: [...urls], ...(server.username === undefined ? {} : { username: server.username }), ...(server.credential === undefined ? {} : { credential: server.credential }) };
+  });
+  if (!iceServers.some(server => server.urls.some(url => /^turns?:/.test(url)))) throw new Error("Assigned call relay is unavailable");
+  return { iceServers, iceCredentialsExpiresAt: reply.iceCredentialsExpiresAt };
+}
+
+/** The bot's media adapter supports UDP TURN. TLS-only assignment fails closed. */
+function supportedIceServers(iceServers) {
+  const usable = iceServers.flatMap(server => {
+    const urls = (Array.isArray(server.urls) ? server.urls : [server.urls]).filter(url => typeof url === 'string' && (url.startsWith('stun:') || (url.startsWith('turn:') && !url.includes('transport=tcp'))));
+    // Werift's parser accepts one string URL per entry; arrays silently lose
+    // their TURN address/username despite matching the browser ICE shape.
+    return urls.map(url => ({ ...server, urls: url }));
+  });
+  if (!usable.some(server => server.urls.startsWith('turn:'))) throw new Error('Call configuration has no supported TURN route');
+  return usable;
+}
+
 function publicCallIdentity(payload = {}) {
   return {
     ...(payload.callAttemptId ? { callAttemptId: payload.callAttemptId } : {}),
@@ -28,6 +56,8 @@ function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000
       if (reply.requestId !== requestId) return;
       if (!reply.ok) return fail("Call room access denied");
       if (reply.protocolVersion !== 3 || typeof reply.callAttemptId !== "string" || !/^[\w-]{16,128}$/.test(reply.callAttemptId)
+        || reply.roomAdmissionRequired !== true
+        || typeof reply.nodeId !== 'string' || !/^[\w-]{1,64}$/.test(reply.nodeId)
         || typeof reply.organizationId !== "string" || !reply.organizationId || reply.deviceId !== input.deviceId
         || !Number.isSafeInteger(reply.roomId) || reply.roomId <= 0 || !Number.isSafeInteger(reply.generation) || reply.generation < 0
         || (input.callAttemptId && reply.callAttemptId !== input.callAttemptId)
@@ -38,8 +68,11 @@ function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000
         || typeof reply.janusToken !== "string" || !reply.janusToken || typeof reply.roomToken !== "string" || !reply.roomToken
         || (reply.leaseExpiresAt !== undefined && (!Number.isFinite(reply.leaseExpiresAt) || reply.leaseExpiresAt <= Date.now()))
         || !Number.isFinite(reply.roomTokenExpiresAt) || reply.roomTokenExpiresAt <= Date.now()) return fail("Invalid call room access response");
+      let assignedIce;
+      try { assignedIce = projectAssignedIce(reply); } catch (_) { return fail("Invalid call room access response"); }
       cleanup();
       resolve({ ...publicCallIdentity(reply), protocolVersion: 3, deviceId: reply.deviceId, generation: reply.generation,
+        roomAdmissionRequired: true, ...assignedIce,
         ...(reply.janusTokenExpiresAt !== undefined ? {janusTokenExpiresAt: reply.janusTokenExpiresAt} : {}),
         chatId: reply.chatId, nodeId: reply.nodeId, ...(reply.server !== undefined ? { server: reply.server } : {}), janusToken: reply.janusToken, roomToken: reply.roomToken, roomTokenExpiresAt: reply.roomTokenExpiresAt, ...(reply.leaseExpiresAt !== undefined ? { leaseExpiresAt: reply.leaseExpiresAt } : {}) });
     };
@@ -50,4 +83,4 @@ function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000
     catch (_) { fail("Call socket unavailable"); }
   });
 }
-module.exports = { publicCallIdentity, requestRoomAccess };
+module.exports = { publicCallIdentity, requestRoomAccess, projectAssignedIce, supportedIceServers };

package/channels/kazee/call/manager.js

@@ -2,7 +2,7 @@
 
 const { randomUUID, randomInt } = require("crypto");
 const { CallLeaseHeartbeat } = require("./lease");
-const { publicCallIdentity, requestRoomAccess } = require("./access");
+const { publicCallIdentity, requestRoomAccess, supportedIceServers } = require("./access");
 const { canonicalForChannel } = require("../../../core/identity");
 const { KazeeCallSession } = require("./session");
 
@@ -56,12 +56,9 @@ class KazeeCallManager {
     catch (_) { throw new Error("Call configuration unavailable"); }
     const config = res?.config;
     if (!config || !Array.isArray(config.iceServers)) throw new Error("Call configuration unavailable");
-    const usable = config.iceServers.flatMap(server => {
-      const urls = (Array.isArray(server.urls) ? server.urls : [server.urls]).filter(url => typeof url === "string" && (url.startsWith("stun:") || (url.startsWith("turn:") && !url.includes("transport=tcp"))));
-      return urls.length ? [{ ...server, urls }] : [];
-    });
-    if (!usable.some(server => server.urls.some(url => url.startsWith("turn:")))) throw new Error("Call configuration has no supported TURN route");
+    const usable = supportedIceServers(config.iceServers);
     return { iceServers: usable, janusServer: config.janusServer || this.janusUrl, janusToken: config.janusToken,
+      iceCredentialsExpiresAt: config.iceCredentialsExpiresAt,
       roomAdmissionEnabled: config.roomAdmissionEnabled === true };
   }
 
@@ -78,12 +75,13 @@ class KazeeCallManager {
   }
 
   _sessionOptions(config, access, identity, signal) {
-    return { janusUrl: access?.server || config.janusServer, iceServers: config.iceServers, janusToken: access?.janusToken || config.janusToken,
-      janusTokenExpiresAt: access?.janusTokenExpiresAt, managedRoom: config.roomAdmissionEnabled, roomToken: access?.roomToken, roomTokenExpiresAt: access?.roomTokenExpiresAt,
-      refreshRoomAccess: config.roomAdmissionEnabled ? async () => {
+    return { janusUrl: access?.server || config.janusServer, iceServers: access ? supportedIceServers(access.iceServers) : config.iceServers, janusToken: access?.janusToken || config.janusToken,
+      iceCredentialsExpiresAt: access?.iceCredentialsExpiresAt ?? config.iceCredentialsExpiresAt,
+      janusTokenExpiresAt: access?.janusTokenExpiresAt, managedRoom: !!access, roomToken: access?.roomToken, roomTokenExpiresAt: access?.roomTokenExpiresAt,
+      refreshRoomAccess: access ? async () => {
         const next = await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, deviceId: this.deviceId }, { signal });
         if (next.server !== access?.server || next.nodeId !== access?.nodeId || next.generation !== access?.generation) throw new Error('Call room placement changed');
-        return next;
+        return { ...next, iceServers: supportedIceServers(next.iceServers) };
       } : undefined };
   }
 
@@ -124,6 +122,7 @@ class KazeeCallManager {
     const identity = publicCallIdentity(payload);
     const reject = (reason) => this.adapter._socket?.emit("call:reject", { ...identity, ...(identity.callAttemptId ? { deviceId: this.deviceId, generation: Number.isSafeInteger(payload.generation) && payload.generation >= 0 ? payload.generation : 0 } : {}), toUserId: callerId, callType, chatId, roomId, reason });
     if (!callerId || !chatId || !Number.isSafeInteger(roomId) || roomId <= 0) return reject("invalid_call");
+    if (payload.roomAdmissionRequired !== undefined && typeof payload.roomAdmissionRequired !== 'boolean') return reject("invalid_call");
     if (callerId !== String(this.adapter.ownerUserId || "")) return reject("not_allowed");
     if (callType !== "audio") return reject("unsupported_media");
     if (this.session || this._pending) return reject("busy");
@@ -133,8 +132,11 @@ class KazeeCallManager {
     let session;
     try {
       const config = await this._fetchCallConfig();
-      if (config.roomAdmissionEnabled && !identity.callAttemptId) throw new Error("Call identity required");
-      const access = config.roomAdmissionEnabled ? await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, chatId, deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
+      // Server event metadata belongs to this attempt. The latest org flag only
+      // controls new outgoing allocation, never an existing call's admission.
+      const managed = payload.roomAdmissionRequired === true;
+      if (managed && !identity.callAttemptId) throw new Error("Call identity required");
+      const access = managed ? await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, chatId, deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
       if (pending.controller.signal.aborted) return;
       const boundIdentity = access ? { ...publicCallIdentity(access), deviceId: this.deviceId, generation: access.generation } : identity;
       session = new this.SessionImpl({ roomId, chatId, callerId, botUserId: this.adapter.botUserId,

package/channels/kazee/call/session.js

@@ -2,6 +2,7 @@
 
 const { MediaStreamTrack, RTCPeerConnection, RtpHeader, RtpPacket } = require("werift");
 const { JanusClient } = require("./janus-client");
+const { projectAssignedIce, supportedIceServers } = require("./access");
 const { AdaptiveTurnDetector, OpusAudioCodec, WEBRTC_SAMPLES, downsample48To16, upsampleTo48 } = require("./audio");
 const { SpeechStream, synthesizePcm, synthesizeStream: synthesizeStreamPcm } = require("./speech-client");
 const ttsVoice = require("../../../core/tts-voice");
@@ -73,7 +74,7 @@ const ACK_CHIME_PCM48 = tonePcm48([{ freq: 660, ms: 90 }, { freq: 990, ms: 110 }
 const THINK_TICK_PCM48 = tonePcm48([{ freq: 520, ms: 90 }], 0.045);
 
 class KazeeCallSession {
-  constructor({ roomId, chatId, callerId, botUserId, janusUrl, janusToken, janusTokenExpiresAt, roomToken, roomTokenExpiresAt, managedRoom = false, refreshRoomAccess, iceServers = [], onTranscript, onEnded, onMediaReady,
+  constructor({ roomId, chatId, callerId, botUserId, janusUrl, janusToken, janusTokenExpiresAt, roomToken, roomTokenExpiresAt, managedRoom = false, refreshRoomAccess, iceServers = [], iceCredentialsExpiresAt, onTranscript, onEnded, onMediaReady,
     maxCallMs, idleMs, finalWaitMs, synthesize = synthesizePcm, synthesizeStream = null, asCaller = false, greeting = null,
     JanusClientImpl = JanusClient, PeerConnectionImpl = RTCPeerConnection, SpeechStreamImpl = SpeechStream } = {}) {
     this.roomId = Number(roomId);
@@ -87,6 +88,7 @@ class KazeeCallSession {
     this.roomTokenExpiresAt = roomTokenExpiresAt;
     this.refreshRoomAccess = refreshRoomAccess;
     this.privateId = null;
+    this.publisherId = null;
     this.greeting = greeting ? String(greeting) : null;
     this._greeted = false;
     this._publisherUp = false;
@@ -97,6 +99,9 @@ class KazeeCallSession {
     this.PeerConnectionImpl = PeerConnectionImpl;
     this.SpeechStreamImpl = SpeechStreamImpl;
     this.iceServers = iceServers;
+    this.iceCredentialsExpiresAt = iceCredentialsExpiresAt;
+    this._transportIceExpiry = new Map();
+    this._transportExpiryTimer = null;
     this.onTranscript = onTranscript || (() => {});
     this.onEnded = onEnded || (() => {});
     this.onMediaReady = onMediaReady || (() => {});
@@ -136,15 +141,22 @@ class KazeeCallSession {
 
   async _roomAuth(force = false) {
     if (!this.managedRoom) return this.roomToken ? { token: this.roomToken } : {};
-    if (force || !this.roomToken || this.roomTokenExpiresAt <= Date.now() + 10000) {
+    if (force || !this.roomToken || this.roomTokenExpiresAt <= Date.now() + 10000 || this.iceCredentialsExpiresAt <= Date.now() + 60000) {
       if (!this.refreshRoomAccess) throw new Error("Call room credentials expired");
       if (!this._roomRefresh) {
         this._roomRefresh = Promise.resolve().then(() => this.refreshRoomAccess()).then(access => {
           if (this.closed) throw new Error("Call ended during credential refresh");
+          const assigned = projectAssignedIce(access);
+          const iceServers = supportedIceServers(assigned.iceServers);
           this.roomToken = access.roomToken;
           this.roomTokenExpiresAt = access.roomTokenExpiresAt;
           if (access.janusToken) this.janus.token = access.janusToken;
           if (access.janusTokenExpiresAt !== undefined) this.janusTokenExpiresAt = access.janusTokenExpiresAt;
+          // Werift captures TURN auth when each ICE transport is constructed.
+          // New credentials apply to future peers, never extend an existing
+          // allocation's immutable deadline or mutate its authentication.
+          this.iceServers = iceServers;
+          this.iceCredentialsExpiresAt = assigned.iceCredentialsExpiresAt;
         }).finally(() => { this._roomRefresh = null; });
       }
       await this._roomRefresh;
@@ -153,6 +165,29 @@ class KazeeCallSession {
     return { token: this.roomToken };
   }
 
+  _newPeerConnection() {
+    const expiresAt = this.iceCredentialsExpiresAt;
+    if (this.managedRoom && (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 1000)) throw new Error("Call relay credentials unavailable");
+    const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
+    if (Number.isFinite(expiresAt)) {
+      this._transportIceExpiry.set(pc, expiresAt);
+      this._armTransportExpiry();
+    }
+    return pc;
+  }
+
+  _armTransportExpiry() {
+    if (this._transportExpiryTimer) clearTimeout(this._transportExpiryTimer);
+    this._transportExpiryTimer = null;
+    if (this.closed || !this._transportIceExpiry.size) return;
+    const deadline = Math.min(...this._transportIceExpiry.values());
+    this._transportExpiryTimer = setTimeout(() => {
+      this._transportExpiryTimer = null;
+      this.close("relay-credentials-expired").catch(() => console.error("Kazee call relay cleanup failed"));
+    }, Math.max(0, deadline - Date.now() - 1000));
+    this._transportExpiryTimer.unref?.();
+  }
+
   async start() {
     await this.janus.connect();
     if (this.closed) { await this.janus.close(); throw new Error("Call ended during setup"); }
@@ -213,10 +248,15 @@ class KazeeCallSession {
       if (data.error_code != null) error.code = Number(data.error_code);
       throw error;
     }
-    if (data.videoroom === "joined") this.privateId = data.private_id ?? null;
+    if (data.videoroom === "joined") {
+      this.privateId = data.private_id ?? null;
+      const publisherId = Number(data.id);
+      if (Number.isSafeInteger(publisherId) && publisherId > 0) this.publisherId = publisherId;
+      else if (this.managedRoom) throw new Error("Managed publisher identity unavailable");
+    }
     for (const publisher of data.publishers || []) {
       const feedId = Number(publisher.id);
-      if (!this.subscribers.has(feedId) && !String(publisher.display || "").startsWith("open-claudia:")) {
+      if (Number.isSafeInteger(feedId) && feedId > 0 && feedId !== this.publisherId && !this.subscribers.has(feedId) && !String(publisher.display || "").startsWith("open-claudia:")) {
         await this._subscribe(feedId, publisher.display);
       }
     }
@@ -264,7 +304,9 @@ class KazeeCallSession {
 
   async _publish() {
     if (this.publisher) return;
-    const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
+    await this._roomAuth();
+    if (this.closed || this.publisher) return;
+    const pc = this._newPeerConnection();
     pc.iceConnectionStateChange?.subscribe?.((state) => {
       clog(`Kazee call publisher ICE: ${state} room=${this.roomId}`);
       if (state === "connected" || state === "completed") {
@@ -324,9 +366,10 @@ class KazeeCallSession {
     this.subscribers.set(feedId, null);
     clog(`Kazee call subscribing: feed=${feedId} display=${String(display || "")}`);
     try {
+      const roomAuth = await this._roomAuth();
       const handle = await this.janus.attach();
       if (this.closed) { await this.janus.detach(handle); this.subscribers.delete(feedId); return; }
-      const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
+      const pc = this._newPeerConnection();
       pc.iceConnectionStateChange?.subscribe?.((state) => clog(`Kazee call subscriber ICE: ${state} feed=${feedId}`));
       const sub = {
         handle,
@@ -357,7 +400,7 @@ class KazeeCallSession {
         if (track.kind === "audio") track.onReceiveRtp.subscribe((packet) => this._onFeedRtp(feedId, packet));
       });
       this.janus.onHandle(handle, (frame) => this._onSubscriberEvent(feedId, frame));
-      const attached = await this.janus.message(handle, { ...(await this._roomAuth()), request: "join", ptype: "subscriber", room: this.roomId, feed: feedId, ...(this.privateId != null ? { private_id: this.privateId } : {}) });
+      const attached = await this.janus.message(handle, { ...roomAuth, request: "join", ptype: "subscriber", room: this.roomId, feed: feedId, ...(this.privateId != null ? { private_id: this.privateId } : {}) });
       await this._consumeSubscriberFrame(feedId, attached);
       await sub.stt.connect().then(
         () => clog(`Kazee call STT connected: feed=${feedId}`),
@@ -758,8 +801,8 @@ class KazeeCallSession {
   async _enforceLimits() {
     if (this.closed || this._ending) return;
     const now = Date.now();
-    if (this.managedRoom && this.janusTokenExpiresAt !== undefined && this.janusTokenExpiresAt <= now + 60000) {
-      if (this.janusTokenExpiresAt <= now) { await this.close("credentials-expired"); return; }
+    if (this.managedRoom && [this.janusTokenExpiresAt, this.roomTokenExpiresAt, this.iceCredentialsExpiresAt].some(expiry => expiry !== undefined && expiry <= now + 60000)) {
+      if ([this.janusTokenExpiresAt, this.roomTokenExpiresAt, this.iceCredentialsExpiresAt].some(expiry => expiry !== undefined && expiry <= now)) { await this.close("credentials-expired"); return; }
       // Uses the same single in-flight request as subscriber room-token refresh.
       // The next limit tick still closes at expiry if this request stalls.
       this._roomAuth(true).catch(() => {});
@@ -785,6 +828,8 @@ class KazeeCallSession {
     const sub = this.subscribers.get(feedId);
     if (!sub) return;
     this.subscribers.delete(feedId);
+    this._transportIceExpiry.delete(sub.pc);
+    this._armTransportExpiry();
     if (sub.finalTimer) clearTimeout(sub.finalTimer);
     try { sub.stt.close(); } catch (_) {}
     try { sub.codec.close(); } catch (_) {}
@@ -795,6 +840,10 @@ class KazeeCallSession {
   async close(reason = "ended") {
     if (this.closed) return;
     this.closed = true;
+    if (this._transportExpiryTimer) clearTimeout(this._transportExpiryTimer);
+    this._transportExpiryTimer = null;
+    const trackedPeers = [...this._transportIceExpiry.keys()];
+    this._transportIceExpiry.clear();
     this._leaseHeartbeat?.close();
     console.log(`Kazee call session closed: room=${this.roomId} reason=${reason}`);
     if (this._limitTimer) { clearInterval(this._limitTimer); this._limitTimer = null; }
@@ -806,6 +855,7 @@ class KazeeCallSession {
       try { await this.janus.message(this.publisherHandle, { request: "destroy", room: this.roomId }); } catch (_) {}
     }
     try { await this.publisher?.pc?.close(); } catch (_) {}
+    for (const pc of trackedPeers) { try { await pc.close(); } catch (_) {} }
     try { await this.janus.detach(this.publisherHandle); } catch (_) {}
     try { await this.janus.close(); } catch (_) {}
     this.codec.close();

package/core/handlers.js

@@ -1684,6 +1684,16 @@ register({
       `Cost: $${u.costUsd.toFixed(4)}`,
       `Last turn context: ${fmt(u.lastInputTokens)}`,
     ];
+    const occupancy = u.liveContextTokens || u.lastInputTokens || 0;
+    if (u.contextWindowTokens > 0) {
+      lines.push(`Context window: ${fmt(occupancy)} of ${fmt(u.contextWindowTokens)} (${Math.round((100 * occupancy) / u.contextWindowTokens)}%)`);
+    }
+    if (u.subagentThreads > 0) {
+      lines.push(`Provider sub-agents: ${u.subagentThreads} thread${u.subagentThreads === 1 ? "" : "s"} · ${fmt(u.subagentInputTokens || 0)} in / ${fmt(u.subagentOutputTokens || 0)} out (spawned by the model; not in the totals above)`);
+    }
+    if (Number.isFinite(u.quotaUsedPercent)) {
+      lines.push(`Plan quota used: ${u.quotaUsedPercent}%${u.quotaResetsAt ? ` (resets ${String(u.quotaResetsAt).slice(0, 16).replace("T", " ")}Z)` : ""}`);
+    }
     if (u.lastInputTokens > 200000) {
       const threshold = effectiveCompactThreshold(currentState());
       if (threshold === 0) {

package/core/providers/codex-events.js

@@ -102,7 +102,9 @@ function normalizeCodexEvent(rawEvent, state = createCodexParserState()) {
     if (state.terminal) return [];
     state.terminal = true;
     const events = [];
-    const usage = normalizedUsage(rawEvent.usage, "session_total", state.seenUsage);
+    // Per-turn by Codex's own definition ("the usage of tokens during a turn",
+    // exec_events.rs) — not a session total; see runner.normalizeCodexUsage.
+    const usage = normalizedUsage(rawEvent.usage, "turn", state.seenUsage);
     if (usage) events.push(usage);
     events.push({
       type: "result",