@jameslovespancakes/pi-plus 1.0.11 → 1.0.13

package/src/domains/subscriptions/accounts.ts

@@ -1,5 +1,10 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { accountRows, openAccountsPicker, type AccountState } from "./accounts-picker.ts";
+import { readStoredCredential, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import {
+  accountRows,
+  openAccountsPicker,
+  providerAccounts,
+  type AccountState,
+} from "./accounts-picker.ts";
 import {
   accountProvider,
   accountProviders,
@@ -35,8 +40,10 @@ async function openBrowser(pi: ExtensionAPI, url: string): Promise<void> {
 function bridge(pi: ExtensionAPI, ctx: any): AccountContext {
   return {
     hasUI: ctx.hasUI,
+    signal: ctx.signal,
     ui: {
       input: (title, placeholder) => ctx.ui.input(title, placeholder),
+      select: (title, options) => ctx.ui.select(title, options),
       confirm: (title, message) => ctx.ui.confirm(title, message),
       notify: (message, type) => ctx.ui.notify(message, type ?? "info"),
     },
@@ -44,11 +51,29 @@ function bridge(pi: ExtensionAPI, ctx: any): AccountContext {
   };
 }
 
+async function primaryAccount(provider: AccountProvider): Promise<ManagedAccount | undefined> {
+  try {
+    const credential = readStoredCredential(provider.id);
+    if (!credential) return undefined;
+    return {
+      id: "main",
+      label: "Primary",
+      enabled: true,
+      expiresAt: credential.type === "oauth" ? credential.expires : undefined,
+      primary: true,
+      identity: credential.type === "oauth" ? await provider.identify?.(credential.access) : undefined,
+    };
+  } catch {
+    // A malformed/unreadable auth file must not hide the sidecar accounts.
+    return undefined;
+  }
+}
+
 function describe(account: ManagedAccount): string {
   const state = !account.enabled
     ? "disabled"
     : account.expiresAt !== undefined && account.expiresAt < Date.now() ? "expired" : "active";
-  return `${account.label.padEnd(20)} ${state}`;
+  return `${account.label.padEnd(20)} ${state}${account.primary ? " · primary" : ""}`;
 }
 
 async function listAll(ctx: any): Promise<void> {
@@ -58,34 +83,34 @@ async function listAll(ctx: any): Promise<void> {
     return;
   }
 
-  const blocks: string[] = [];
-  for (const provider of providers) {
+  const blocks = await Promise.all(providers.map(async (provider): Promise<string[]> => {
     try {
-      const accounts = await provider.list();
-      const routing = provider.routing ? ` · routing: ${await provider.routing.get()}` : "";
-      blocks.push(
+      const [accounts, mode] = await Promise.all([
+        providerAccounts(provider, primaryAccount),
+        provider.routing?.get(),
+      ]);
+      const routing = mode ? ` · routing: ${mode}` : "";
+      return [
         `${provider.label} (${provider.id})${routing}`,
         ...(accounts.length > 0
           ? accounts.map((account) => `  ${describe(account)}`)
-          : [`  no additional accounts, add one with /account ${provider.id} add`]),
-      );
+          : [`  no additional accounts, add one with /accounts add ${provider.id}`]),
+      ];
     } catch (error) {
-      blocks.push(`${provider.label} (${provider.id}): ${error instanceof Error ? error.message : String(error)}`);
+      return [`${provider.label} (${provider.id}): ${error instanceof Error ? error.message : String(error)}`];
     }
-  }
-  ctx.ui.notify(blocks.join("\n"), "info");
+  }));
+  ctx.ui.notify(blocks.flat().join("\n"), "info");
 }
 
-
-
 async function pickAccount(ctx: any, provider: AccountProvider): Promise<string | undefined> {
-  const accounts = await provider.list();
+  const accounts = (await provider.list()).filter((account) => !account.primary);
   if (accounts.length === 0) {
-    ctx.ui.notify(`No ${provider.label} accounts yet. Add one with /account ${provider.id} add.`, "info");
+    ctx.ui.notify(`No ${provider.label} accounts yet. Add one with /accounts add ${provider.id}.`, "info");
     return undefined;
   }
   if (!ctx.hasUI) {
-    ctx.ui.notify(`Specify an account: /account ${provider.id} reauth <label>`, "warning");
+    ctx.ui.notify(`Choose an account with /accounts reauth ${provider.id}.`, "warning");
     return undefined;
   }
 
@@ -96,30 +121,25 @@ async function pickAccount(ctx: any, provider: AccountProvider): Promise<string
 }
 
 export function registerAccountCommands(pi: ExtensionAPI): void {
-  /** Toggles one account and returns the state it ended in. */
   const toggle = (providerId: string, accountId: string): AccountState => {
     const provider = accountProvider(providerId);
     if (!provider?.setEnabled) throw new Error(`${providerId} accounts cannot be disabled.`);
     const next = pendingState.get(`${providerId}:${accountId}`) === "enabled" ? "disabled" : "enabled";
     pendingState.set(`${providerId}:${accountId}`, next);
-    // Adapters persist asynchronously; the picker needs the answer now, so the
-    // write is fired off and failures surface as a notification.
     void provider.setEnabled(accountId, next === "enabled").catch(() => {});
     return next;
   };
 
-  /** Mirror of on-disk state, so the synchronous toggle can answer instantly. */
   const pendingState = new Map<string, AccountState>();
 
   const rows = async () => {
-    const list = await accountRows(accountProviders());
+    const list = await accountRows(accountProviders(), primaryAccount);
     pendingState.clear();
     for (const row of list) pendingState.set(row.id, row.state);
     return list;
   };
 
-  /** Adds an account: choose provider, name it, authorize. */
-  async function addAccount(ctx: any, providerId?: string): Promise<void> {
+  async function addAccount(ctx: any, providerId?: string, requestedLabel?: string): Promise<void> {
     if (!ctx.hasUI) {
       ctx.ui.notify("Adding an account requires interactive Pi mode.", "error");
       return;
@@ -144,7 +164,8 @@ export function registerAccountCommands(pi: ExtensionAPI): void {
     }
     if (!provider) return;
 
-    const label = await ctx.ui.input(`${provider.label} account name`, "Work, Personal, etc.");
+    const label = requestedLabel?.trim()
+      || await ctx.ui.input(`${provider.label} account name`, "Work, Personal, etc.");
     if (!label?.trim()) return;
 
     try {
@@ -155,14 +176,13 @@ export function registerAccountCommands(pi: ExtensionAPI): void {
     }
   }
 
-  /** Rename wizard: pick an account, type a new name. */
   async function renameAccount(ctx: any): Promise<void> {
     if (!ctx.hasUI) {
       ctx.ui.notify("Renaming an account requires interactive Pi mode.", "error");
       return;
     }
-    const list = await accountRows(accountProviders());
-    const renameable = list.filter((row) => accountProvider(row.providerId)?.rename);
+    const list = await accountRows(accountProviders(), primaryAccount);
+    const renameable = list.filter((row) => !row.primary && accountProvider(row.providerId)?.rename);
     if (renameable.length === 0) {
       ctx.ui.notify("No accounts can be renamed.", "info");
       return;
@@ -179,7 +199,6 @@ export function registerAccountCommands(pi: ExtensionAPI): void {
 
     const provider = accountProvider(row.providerId);
     try {
-      // Row ids are "<providerId>:<accountId>"; strip the prefix.
       await provider!.rename!(row.id.slice(row.providerId.length + 1), next.trim());
       ctx.ui.notify(`Renamed to “${next.trim()}”.`, "info");
     } catch (error) {
@@ -202,15 +221,15 @@ export function registerAccountCommands(pi: ExtensionAPI): void {
         .map((id) => ({ value: `${parts[0]} ${id}`, label: id }));
     },
     handler: async (args, ctx) => {
-      const [action, providerId] = args.trim().split(/\s+/).filter(Boolean);
+      const [action, providerId, ...rest] = args.trim().split(/\s+/).filter(Boolean);
 
-      if (action === "add") return addAccount(ctx, providerId);
+      if (action === "add") return addAccount(ctx, providerId, rest.join(" ") || undefined);
       if (action === "rename") return renameAccount(ctx);
 
       if (action === "reauth") {
         const provider = providerId ? accountProvider(providerId) : accountProviders()[0];
         if (!provider) { ctx.ui.notify("No subscription providers are registered.", "error"); return; }
-        const target = await pickAccount(ctx, provider);
+        const target = rest.join(" ") || await pickAccount(ctx, provider);
         if (!target) return;
         try {
           const done = await provider.reauth(bridge(pi, ctx), target);
@@ -226,11 +245,9 @@ export function registerAccountCommands(pi: ExtensionAPI): void {
         return;
       }
 
-      // Bare /accounts: the picker interactively, plain text headless.
       if (!ctx.hasUI) return listAll(ctx);
 
-      // The picker closes to run a wizard, then reopens so the result is
-      // visible immediately. Bounded so a misbehaving action cannot spin.
+      // Reopen after each wizard so changes appear immediately.
       for (let step = 0; step < 24; step++) {
         const requested = await openAccountsPicker(ctx, { rows, toggle });
         if (!requested) return;

package/src/domains/subscriptions/footer.ts

@@ -4,20 +4,55 @@ import { refreshUsage, startPolling, stopPolling, subscribe, usageState } from "
 import { renderUsageLines, usageSummaryText } from "../../ui/usage-bars.ts";
 import { formatTokens, sanitize } from "../../ui/format.ts";
 
-/**
- * Single-line session footer (no working-directory line) with the subscription
- * bars rendered directly underneath it.
- *
- * The footer no longer owns the poll loop; it subscribes to usage-service and
- * re-renders on change. That is what lets non-UI consumers get fresh data.
- */
+/** Compact session footer with shared subscription usage bars. */
 
-const SUBSCRIPTION_PROVIDERS = new Set(["anthropic", "openai-codex", "kimi-coding"]);
+const SUBSCRIPTION_PROVIDERS = new Set(["anthropic", "openai-codex", "kimi-coding", "xai"]);
+
+interface SessionTotals {
+  input: number;
+  output: number;
+  cacheRead: number;
+  cacheWrite: number;
+  cost: number;
+  latestHitRate?: number;
+}
+
+function usageFor(entry: any): any {
+  if (entry.type === "message") {
+    return entry.message.role === "assistant" || entry.message.role === "toolResult" ? entry.message.usage : undefined;
+  }
+  return entry.type === "branch_summary" || entry.type === "compaction" ? entry.usage : undefined;
+}
+
+function sumSessionUsage(entries: any[]): SessionTotals {
+  const totals: SessionTotals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0 };
+  for (const entry of entries) {
+    const usage = usageFor(entry);
+    if (!usage) continue;
+    totals.input += usage.input ?? 0;
+    totals.output += usage.output ?? 0;
+    totals.cacheRead += usage.cacheRead ?? 0;
+    totals.cacheWrite += usage.cacheWrite ?? 0;
+    totals.cost += usage.cost?.total ?? 0;
+    if (entry.type === "message" && entry.message.role === "assistant") {
+      const prompt = (usage.input ?? 0) + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
+      totals.latestHitRate = prompt > 0 ? ((usage.cacheRead ?? 0) / prompt) * 100 : undefined;
+    }
+  }
+  return totals;
+}
+
+function usageSignature(entries: any[]): string {
+  const last = entries.at(-1);
+  const usage = last ? usageFor(last) : undefined;
+  return [entries.length, last?.id, usage?.input, usage?.output, usage?.cacheRead, usage?.cacheWrite, usage?.cost?.total].join(":");
+}
 
 export function registerFooter(pi: ExtensionAPI): void {
   let showUsage = true;
   let requestRender: (() => void) | undefined;
   let unsubscribe: (() => void) | undefined;
+  let cachedUsage: { signature: string; totals: SessionTotals } | undefined;
 
   const apply = (ctx: any) => {
     if (!ctx.hasUI) return;
@@ -34,28 +69,12 @@ export function registerFooter(pi: ExtensionAPI): void {
           const width = Math.max(1, Math.floor(Number(rawWidth) || 0));
           const lines: string[] = [];
 
-          let input = 0;
-          let output = 0;
-          let cacheRead = 0;
-          let cacheWrite = 0;
-          let cost = 0;
-          let latestHitRate: number | undefined;
-
-          for (const entry of ctx.sessionManager.getEntries()) {
-            const usage = entry.type === "message"
-              ? (entry.message.role === "assistant" || entry.message.role === "toolResult" ? entry.message.usage : undefined)
-              : (entry.type === "branch_summary" || entry.type === "compaction" ? entry.usage : undefined);
-            if (!usage) continue;
-            input += usage.input ?? 0;
-            output += usage.output ?? 0;
-            cacheRead += usage.cacheRead ?? 0;
-            cacheWrite += usage.cacheWrite ?? 0;
-            cost += usage.cost?.total ?? 0;
-            if (entry.type === "message" && entry.message.role === "assistant") {
-              const prompt = (usage.input ?? 0) + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
-              latestHitRate = prompt > 0 ? ((usage.cacheRead ?? 0) / prompt) * 100 : undefined;
-            }
+          const entries = ctx.sessionManager.getEntries();
+          const signature = usageSignature(entries);
+          if (cachedUsage?.signature !== signature) {
+            cachedUsage = { signature, totals: sumSessionUsage(entries) };
           }
+          const { input, output, cacheRead, cacheWrite, cost, latestHitRate } = cachedUsage.totals;
 
           const parts: string[] = [];
           if (input) parts.push(`↑${formatTokens(input)}`);

package/src/domains/subscriptions/index.ts

@@ -1,40 +1,24 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { registerAccountProvider } from "../../core/accounts/registry.ts";
 import { anthropicAccounts } from "./providers/anthropic.ts";
-import { codexAccounts } from "./providers/codex.ts";
+import { codexAccounts, CODEX_SPEC } from "./providers/codex.ts";
+import { kimiAccounts, KIMI_SPEC, xaiAccounts, XAI_SPEC } from "./providers/hosted.ts";
+import { registerPooledOAuthProvider } from "./providers/oauth-pool.ts";
 import { registerAnthropicProvider } from "./provider.ts";
 import { registerAccountCommands } from "./accounts.ts";
 import { registerRoutingCommands } from "./routing.ts";
 import { registerFooter } from "./footer.ts";
 
-/**
- * Subscriptions domain: Claude OAuth accounts, routing mode, and the quota HUD.
- *
- * This replaces the old `claude-multi-account.ts` + `compact-footer.ts` pair.
- * Account and routing commands are provider-agnostic: `/account <provider>` and
- * `/routing` dispatch through core/accounts/registry.ts, so adding a second
- * provider means writing one adapter, not new commands.
- * Authentication and model catalogue are separate concerns here; they were only
- * ever colocated because they shared an OAuth token.
- *
- * Relationship to @cortexkit/pi-anthropic-auth:
- *   That package stays installed and keeps ownership of the Anthropic provider,
- *   its stream implementation, and its own commands (/claude-account,
- *   /claude-routing, /claude-quota, ...). Absorbing it fully was evaluated and
- *   rejected, because its `dist/commands.js` exports only `registerCommands(pi)` as a
- *   unit, so taking over individual commands would mean copying ~130 lines of
- *   provider/model specs that drift on every vendor upgrade. This domain adds
- *   the multi-account surface the vendor does not provide, and everything it
- *   touches goes through src/vendor/anthropic.ts.
- */
+/** Registers subscription providers, pooled accounts, routing, and usage UI. */
 export default function subscriptions(pi: ExtensionAPI) {
-  // Adapters register first so the generic commands can see them.
-  registerAccountProvider(anthropicAccounts);
-  registerAccountProvider(codexAccounts);
+  for (const provider of [anthropicAccounts, codexAccounts, kimiAccounts, xaiAccounts]) {
+    registerAccountProvider(provider);
+  }
 
-  // Own the Anthropic provider unless explicitly told to defer to cortexkit.
-  // PI_PLUS_VENDOR_ANTHROPIC=1 restores the vendored package.
-  if (process.env.PI_PLUS_VENDOR_ANTHROPIC !== "1") registerAnthropicProvider(pi);
+  registerAnthropicProvider(pi);
+  registerPooledOAuthProvider(pi, CODEX_SPEC);
+  registerPooledOAuthProvider(pi, KIMI_SPEC);
+  registerPooledOAuthProvider(pi, XAI_SPEC);
 
   registerAccountCommands(pi);
   registerRoutingCommands(pi);

package/src/domains/subscriptions/provider.ts

@@ -3,64 +3,83 @@ import { authorize, exchange, refreshToken } from "../../core/anthropic/oauth.ts
 import {
   billingHeader, clientIdentityHeaders, firstUserText, prependPromptBlock, signRequestBody, splitSystemPrompt,
 } from "../../core/anthropic/client-identity.ts";
+import {
+  anthropicAccountIdentity,
+  cachedAnthropicAccountIdentity,
+} from "../../core/anthropic/identity.ts";
 import { ANTHROPIC_MODELS } from "../../core/anthropic/models.ts";
-import { applyQuotaHeaders, refreshAllQuota } from "../../core/anthropic/quota.ts";
-import { applyCodexQuotaHeaders } from "../../core/codex/quota.ts";
-import { loadCodexAccounts } from "../../core/codex/store.ts";
+import {
+  ACCESS_REFRESH_INTERVAL_MS,
+  applyQuotaHeaders,
+  refreshAllQuota,
+} from "../../core/anthropic/quota.ts";
 import {
   MAIN_ACCOUNT_ID, familyForModel, selectAccount, type Candidate,
 } from "../../core/anthropic/routing.ts";
 import { getRoutingMode, loadAccounts, saveAccount } from "../../core/anthropic/store.ts";
 
 /**
- * The Anthropic provider.
- *
- * Rather than reimplementing the Messages API, this registers pi's built-in
- * `anthropic-messages` implementation and supplies only the credential. pi
- * resolves auth per request, so `getApiKey` is the hook where account routing
- * happens: it returns the token of whichever account the router picked.
- *
- * Consequences of that choice, stated plainly:
- *   - `getApiKey` is synchronous, so selection reads the CACHED quota snapshot.
- *     A background timer keeps it fresh instead of polling inline.
- *   - A mid-stream 429 is handled by pi's retry rather than by migrating the
- *     in-flight request to another account. The next request routes elsewhere
- *     once the failure is recorded, which is a real behavioural difference from
- *     the vendored provider.
- *
- * What this buys: pi's streaming, tool conversion, cost accounting and retry
- * logic are reused unchanged, instead of a 1,500-line reimplementation whose
- * edge cases we could not see.
+ * Anthropic uses pi's Messages API client with per-request account routing.
+ * Routing reads cached quota; a 429 affects the next request, not its stream.
+ */
+
+/**
+ * The hook is global, so require both Anthropic's payload shape and a Claude
+ * model. This prevents `system` injection into other provider requests.
  */
+function isAnthropicMessagesPayload(payload: any): boolean {
+  if ("instructions" in payload || "input" in payload) return false;
+  if (!Array.isArray(payload.messages)) return false;
+  const model = typeof payload.model === "string" ? payload.model.toLowerCase() : "";
+  return model.startsWith("claude") || ANTHROPIC_MODELS.some((m: any) => m.id === payload.model);
+}
 
 let lastSelected: { id: string; at: number } | undefined;
+const accountLastUsed = new Map<string, number>();
 
 /** Which account served the most recent request, for the UI. */
 export function lastRoutedAccount(): { id: string; at: number } | undefined {
   return lastSelected;
 }
 
-/**
- * Chooses an account and returns its access token.
- *
- * `primary` is pi's own credential, which participates as `main` at order 0.
- * Falls back to the primary token whenever routing has nothing better, so a
- * single-account setup behaves exactly as it did before any of this existed.
- */
-// `_sessionId` is accepted for signature compatibility with pi's per-request
-// hook; stickiness is derived from stored assignments rather than the id.
+/** Routes to a pooled account, falling back to pi's primary credential. */
 export function routeAccessToken(primary: string, modelId?: string, _sessionId?: string): string {
   const storage = loadAccounts();
   if (!storage) return primary;
 
   const mode = getRoutingMode(storage);
   const family = familyForModel(modelId);
+  const primaryIdentity = cachedAnthropicAccountIdentity(primary);
+  if (!primaryIdentity) void anthropicAccountIdentity(primary).catch(() => {});
+  const identities = new Set(primaryIdentity ? [primaryIdentity] : []);
+  const sidecars = storage.accounts.filter((account) => {
+    if (account.enabled === false || account.type !== "oauth" || !account.access
+      || typeof account.expires !== "number" || account.expires <= Date.now()) return false;
+    if (!account.identity) return true;
+    if (identities.has(account.identity)) return false;
+    identities.add(account.identity);
+    return true;
+  });
 
   const candidates: Candidate[] = [
-    { id: MAIN_ACCOUNT_ID, access: primary, quota: storage.main?.quota as any, order: 0 },
-    ...storage.accounts
-      .filter((a) => a.enabled !== false && a.type === "oauth" && a.access)
-      .map((a, index) => ({ id: a.id, access: a.access, quota: a.quota, order: index + 1, account: a })),
+    {
+      id: MAIN_ACCOUNT_ID,
+      access: primary,
+      quota: storage.main?.quota as any,
+      order: 0,
+      lastUsed: accountLastUsed.get(MAIN_ACCOUNT_ID) ?? Number(storage.main?.lastUsed ?? 0),
+    },
+    // Never route an expired/unknown-lifetime sidecar while its asynchronous
+    // refresher catches up; falling back to pi's primary is safer than a 401.
+    // Stable identities also keep duplicate logins from inflating the pool.
+    ...sidecars.map((a, index) => ({
+        id: a.id,
+        access: a.access,
+        quota: a.quota,
+        order: index + 1,
+        lastUsed: accountLastUsed.get(a.id) ?? a.lastUsed ?? 0,
+        account: a,
+      })),
   ];
 
   // Nothing to choose between: keep pi's own credential.
@@ -75,10 +94,9 @@ export function routeAccessToken(primary: string, modelId?: string, _sessionId?:
 
   const now = Date.now();
   lastSelected = { id: picked.candidate.id, at: now };
+  accountLastUsed.set(picked.candidate.id, now);
   if (picked.candidate.account) {
-    // `lastUsed` only orders the footer's account list, so second-level
-    // precision buys nothing. Persisting it on every request rewrote two
-    // credential files per call; once a minute is indistinguishable in the UI.
+    // Minute precision avoids a credential write on every request.
     const previous = picked.candidate.account.lastUsed ?? 0;
     if (now - previous > 60_000) {
       saveAccount({ ...picked.candidate.account, lastUsed: now });
@@ -102,9 +120,7 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
     baseUrl: "https://api.anthropic.com",
     api: "anthropic-messages",
     models: ANTHROPIC_MODELS,
-    // See core/anthropic/client-identity.ts. Without these, Anthropic bills
-    // requests to extra usage rather than plan limits. Delete that import and
-    // this line to opt out; nothing else depends on it.
+    // Required for subscription billing. See client-identity.ts.
     headers: clientIdentityHeaders(),
     oauth: {
       name: "Anthropic Claude Pro/Max",
@@ -114,29 +130,15 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
         const refreshed = await refreshToken({ refreshToken: credentials.refresh });
         return { access: refreshed.access, refresh: refreshed.refresh, expires: refreshed.expires };
       },
-      // The routing hook. pi calls this per request.
       getApiKey: (credentials: any) => routeAccessToken(credentials.access),
     },
   });
 
-  /**
-   * Reshapes the request the way the endpoint requires, then signs it.
-   *
-   * Three things have to happen, in order:
-   *   1. pi's system prompt is split. The documentation paragraph cannot live in
-   *      `system` at all, or Anthropic answers 400 "Third-party apps now draw
-   *      from your extra usage"; it moves into the first user message instead.
-   *   2. The billing header goes first in `system`, alongside the Claude Code
-   *      identity line.
-   *   3. The body is signed, which must happen last because the checksum covers
-   *      the canonicalised body.
-   *
-   * See core/anthropic/client-identity.ts for what all of this is and the
-   * caveats around it.
-   */
+  /** Rebuilds the Anthropic prompt, then signs the final body. */
   pi.on("before_provider_request", async (event: any) => {
     const payload = event?.payload;
     if (!payload || typeof payload !== "object") return undefined;
+    if (!isAnthropicMessagesPayload(payload)) return undefined;
 
     const serialized = typeof payload.system === "string"
       ? payload.system
@@ -156,20 +158,10 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
     return JSON.parse(signed);
   });
 
-  /**
-   * Free quota refresh for whichever account just served a request.
-   *
-   * Anthropic returns the same utilisation numbers as the usage endpoint in
-   * `anthropic-ratelimit-unified-*` response headers, so the active account
-   * stays current without spending a request on asking.
-   *
-   * `lastRoutedAccount()` is set by `getApiKey` immediately before the call,
-   * which is what lets the reply be attributed to the right account.
-   */
+  /** Updates the routed account from response quota headers. */
   pi.on("after_provider_response", (event: any) => {
     const routed = lastRoutedAccount();
-    // `main` lives in pi's auth.json, not in storage.accounts, so there is no
-    // per-account record to update for it.
+    // The primary account lives in pi's auth store.
     if (!routed || routed.id === MAIN_ACCOUNT_ID) return;
     try {
       applyQuotaHeaders(routed.id, event?.headers);
@@ -179,48 +171,32 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
   });
 
   /**
-   * The same trick for Codex, which reports usage as `x-codex-*` headers.
-   *
-   * Codex has no usage endpoint, so headers are the ONLY quota source: an
-   * account that is not serving traffic keeps whatever snapshot it last had.
-   * Attribution is by `chatgpt-account-id` on the request, since Codex
-   * requests carry the account explicitly rather than only in the token.
+   * Keep rotating sidecar credentials even while their quota snapshot is fresh.
+   * CortexKit refreshes fallbacks on an independent background cadence for the
+   * same reason: quota freshness is not credential freshness.
    */
-  pi.on("after_provider_response", (event: any) => {
-    const headers = event?.headers;
-    if (!headers) return;
-    const hasCodexQuota = Object.keys(headers).some((k) => k.toLowerCase().startsWith("x-codex-"));
-    if (!hasCodexQuota) return;
-    try {
-      const sent = event?.request?.headers ?? {};
-      const accountId = sent["chatgpt-account-id"] ?? sent["Chatgpt-Account-Id"];
-      const match = loadCodexAccounts().accounts.find(
-        (a) => (accountId ? a.accountId === accountId : false) || a.enabled !== false,
-      );
-      if (match) applyCodexQuotaHeaders(match.id, headers);
-    } catch {
-      // Bookkeeping only.
-    }
-  });
+  let refreshTimer: ReturnType<typeof setInterval> | undefined;
+  const startRefreshLoop = () => {
+    if (refreshTimer) return;
+    refreshTimer = setInterval(
+      () => void refreshAllQuota().catch(() => {}),
+      ACCESS_REFRESH_INTERVAL_MS + Math.floor(Math.random() * 30_000),
+    );
+    refreshTimer.unref?.();
+  };
 
-  /**
-   * Idle accounts still need polling, because routing compares accounts and
-   * response headers only ever refresh the one that served traffic.
-   *
-   * Triggered by sending a message, not by a timer, and `refreshAllQuota`
-   * skips accounts whose snapshot is still fresh. So the poll rate is at most
-   * once per QUOTA_FRESH_MS however fast messages are sent, and an idle
-   * session costs nothing at all. The previous 5 minute interval ran forever
-   * regardless of activity and was being answered with 429s.
-   *
-   * `input` is the per-message hook; `turn_start` would fire once per LLM
-   * response, which is many times per message in a tool-use loop.
-   */
   pi.on("input", async () => {
+    startRefreshLoop();
     void refreshAllQuota().catch(() => {});
   });
 
   pi.on("session_start", async () => {
+    startRefreshLoop();
     void refreshAllQuota().catch(() => {});
   });
+
+  pi.on("session_shutdown", async () => {
+    if (refreshTimer) clearInterval(refreshTimer);
+    refreshTimer = undefined;
+  });
 }