@kaitranntt/ccs 8.6.1 → 8.7.0-dev.10

package/dist/web-server/usage/native-quota-collector.js

@@ -15,11 +15,48 @@
  *   - circuit breaker stops calling after repeated 429s for a cooldown
  *   - serve-stale-on-failure; only omit a row when there is genuinely no data
  *
- * Claude path: reads native credentials + polls api.anthropic.com/api/oauth/usage.
+ * Claude path: reads per-profile .credentials.json (file-only, NO keychain)
+ * and polls api.anthropic.com/api/oauth/usage. If the file is absent the
+ * profile is emitted as a parked row (paused:true) — never a keychain call.
+ *
  * Codex path: PRIMARY = live network (chatgpt.com/backend-api/wham/usage, via
  * fetchCodexQuota), FALLBACK = local session logs (getCodexLocalQuota), mirroring
  * the same safety pattern as the Claude path.
+ *
+ * Multi-profile: each Claude or Codex profile gets its own ProviderState so a
+ * 429 on one profile never trips the breaker of another. The active/default
+ * profile for each surface is live-polled (paused:false); all other profiles are
+ * cache-only (paused:true, force=false hardcoded) so the 2.5s /summary deadline
+ * is maintained — at most 2 live upstream calls per /summary regardless of
+ * profile count.
+ *
+ * NO macOS Keychain access anywhere in this module. The old global-default
+ * Claude reader (readClaudeCredentials) is kept for back-compat but is no longer
+ * used by the multi-profile path.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCachedNativeAccountRows = exports.getNativeAccountRows = exports.resetNativeQuotaState = void 0;
 const claude_native_credentials_1 = require("./claude-native-credentials");
@@ -27,12 +64,25 @@ const quota_fetcher_claude_1 = require("../../cliproxy/quota/quota-fetcher-claud
 const quota_fetcher_codex_1 = require("../../cliproxy/quota/quota-fetcher-codex");
 const query_1 = require("../../cliproxy/accounts/query");
 const codex_local_quota_collector_1 = require("./codex-local-quota-collector");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const config_manager_1 = require("../../utils/config-manager");
 // ============================================================================
 // Safety constants (concrete, named, module-level)
 // ============================================================================
 /** On-demand cache TTL. Floor is 5 min; we use 10 min because the bar polls
  *  /summary far more often than a hook fires. */
 const NATIVE_QUOTA_TTL_MS = 600000; // 10 minutes
+// After a 401/expired result, cache the reauth row and cool the profile down so
+// an expired account is shown dimmed and re-checked at most this often instead
+// of being re-polled (and re-401'd) on every /summary refresh.
+const REAUTH_COOLDOWN_MS = NATIVE_QUOTA_TTL_MS; // 10 minutes
+// Parked rows (no on-disk creds, quotaStatus 'unsupported') re-check on a short
+// TTL — re-statting credentials is cheap, and this lets a profile that the user
+// just logged into appear within seconds instead of staying dimmed for the full
+// quota TTL. (Reauth/error rows keep the full TTL + cooldown to avoid re-401s.)
+const PARKED_TTL_MS = 30000; // 30 seconds
 /** Exponential backoff base; delay = min(base * 2^n, MAX) + jitter. */
 const RETRY_BASE_MS = 1000;
 /** Ceiling for any single backoff / Retry-After cooldown derived from one call. */
@@ -43,8 +93,19 @@ const JITTER_MAX_MS = 500;
 const CB_TRIP_THRESHOLD = 3;
 /** How long the breaker stays open (zero network) once tripped. */
 const CB_COOLDOWN_MS = 900000; // 15 minutes
-const CLAUDE_PROVIDER = 'claude-code';
-const CODEX_PROVIDER = 'codex';
+// Surface identifiers
+const SURFACE_CLAUDE = 'ccs';
+const SURFACE_CODEX = 'ccsx';
+// The "default way of running" a surface — the bare login (e.g. ~/.codex for
+// ccsx), as opposed to a named `ccsx <profile>` profile. Rendered in the Bar as
+// the base command ("ccsx") with a "default" badge, not as a named profile.
+const DEFAULT_PROFILE = 'default';
+// Provider values on the wire (unchanged from before)
+const CLAUDE_NATIVE_PROVIDER = 'claude-code';
+const CODEX_NATIVE_PROVIDER = 'codex';
+// Keep old names as aliases to avoid breaking the existing global collector path
+const CLAUDE_PROVIDER = CLAUDE_NATIVE_PROVIDER;
+const CODEX_PROVIDER = CODEX_NATIVE_PROVIDER;
 function freshProviderState() {
     return {
         cachedRow: null,
@@ -56,12 +117,21 @@ function freshProviderState() {
         backoffAttempt: 0,
     };
 }
-const claudeState = freshProviderState();
-const codexState = freshProviderState();
+// Per-profile state maps (key = profile name)
+const claudeProfileStates = new Map();
+const codexProfileStates = new Map();
+function getState(map, key) {
+    let s = map.get(key);
+    if (!s) {
+        s = freshProviderState();
+        map.set(key, s);
+    }
+    return s;
+}
 /** Reset all module state. Tests call this to avoid cross-test pollution. */
 function resetNativeQuotaState() {
-    Object.assign(claudeState, freshProviderState());
-    Object.assign(codexState, freshProviderState());
+    claudeProfileStates.clear();
+    codexProfileStates.clear();
 }
 exports.resetNativeQuotaState = resetNativeQuotaState;
 // ============================================================================
@@ -174,12 +244,15 @@ function buildClaudeQuotaWindows(quota) {
     }
     return windows;
 }
-function buildClaudeRow(quota, tier, now) {
+function buildClaudeRow(quota, tier, now, surface, profile) {
     const quotaWindows = buildClaudeQuotaWindows(quota);
     return {
-        account_id: CLAUDE_PROVIDER,
-        provider: CLAUDE_PROVIDER,
-        displayName: 'Claude Code',
+        account_id: `${surface}:${profile}`,
+        provider: CLAUDE_NATIVE_PROVIDER,
+        surface,
+        profile,
+        is_subscription: true,
+        displayName: profile,
         tier,
         paused: false,
         quota_percentage: deriveClaudeQuotaPercentage(quota),
@@ -208,12 +281,15 @@ function buildCodexQuotaWindows(quota) {
         windowMinutes: w.windowMinutes,
     }));
 }
-function buildCodexRow(quota, now) {
+function buildCodexRow(quota, now, surface, profile) {
     const quotaWindows = buildCodexQuotaWindows(quota);
     return {
-        account_id: CODEX_PROVIDER,
-        provider: CODEX_PROVIDER,
-        displayName: 'Codex',
+        account_id: `${surface}:${profile}`,
+        provider: CODEX_NATIVE_PROVIDER,
+        surface,
+        profile,
+        is_subscription: true,
+        displayName: profile,
         tier: quota.tier,
         paused: false,
         quota_percentage: quota.quotaPercentage,
@@ -240,7 +316,7 @@ function buildCodexRow(quota, now) {
  * stable keys as the Claude path. quota_percentage = min remaining across present
  * core windows. next_reset = soonest core resetAt. No staleAsOf on a live result.
  */
-function buildCodexNetworkRow(quota, now) {
+function buildCodexNetworkRow(quota, now, surface, profile) {
     const windows = [];
     const fiveHour = quota.coreUsage?.fiveHour;
     if (fiveHour) {
@@ -276,9 +352,12 @@ function buildCodexNetworkRow(quota, now) {
         .sort((a, b) => a.ms - b.ms);
     const nextReset = resets.length > 0 ? resets[0].iso : null;
     return {
-        account_id: CODEX_PROVIDER,
-        provider: CODEX_PROVIDER,
-        displayName: 'Codex',
+        account_id: `${surface}:${profile}`,
+        provider: CODEX_NATIVE_PROVIDER,
+        surface,
+        profile,
+        is_subscription: true,
+        displayName: profile,
         tier: quota.planType ?? null,
         paused: false,
         quota_percentage: quotaPercentage,
@@ -302,17 +381,599 @@ function serveCached(state) {
     return { ...state.cachedRow, cached: true };
 }
 // ============================================================================
-// Claude path with full safety controls
+// File-only Claude credentials reader for per-profile paths (NO keychain)
+// ============================================================================
+/**
+ * Read credentials for a specific Claude Code profile (file-only, no keychain).
+ *
+ * Looks for .credentials.json in the profile's instance directory. If the file
+ * is absent or unparseable, returns null — the caller emits a parked row.
+ * Never calls security/Keychain — zero new keychain access from this feature.
+ */
+function readClaudeCredentialsForProfileFromDisk(profile, readDefaultCredentials = claude_native_credentials_1.readClaudeCredentials) {
+    try {
+        const instanceDir = path.join((0, config_manager_1.getCcsDir)(), 'instances', profile);
+        const credFile = path.join(instanceDir, '.credentials.json');
+        if (fs.existsSync(credFile)) {
+            const raw = fs.readFileSync(credFile, 'utf8');
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+            return null;
+        }
+        // The bare `ccs` default login uses the standard global credential lookup:
+        // ~/.claude/.credentials.json, falling back to the single global
+        // "Claude Code-credentials" Keychain item that Claude Code itself maintains.
+        // This is the ONE pre-existing global read the shipped Bar already performs --
+        // NOT a per-profile Keychain scan. Isolated `ccs auth` profiles stay
+        // file-only and never touch the Keychain; a real instance directory named
+        // "default" is therefore parked when its file is absent.
+        if (profile === DEFAULT_PROFILE && !fs.existsSync(instanceDir)) {
+            return readDefaultCredentials();
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+// ============================================================================
+// Profile enumeration helpers (production implementations, DI-overridable)
 // ============================================================================
+/**
+ * Read Codex native auth from the profile's on-disk auth.json.
+ * 'personal' reads ~/.codex/auth.json; other names read codex-instances/<name>/auth.json.
+ * Returns null when absent or unparseable.
+ */
+function readCodexNativeAuthFromDisk(profile) {
+    try {
+        let authPath;
+        if (profile === DEFAULT_PROFILE) {
+            authPath = path.join(os.homedir(), '.codex', 'auth.json');
+        }
+        else {
+            // resolveCodexProfileDir would validate, but we do it inline to avoid the
+            // import coupling and to handle invalid names gracefully (return null).
+            const instancesDir = path.join((0, config_manager_1.getCcsDir)(), 'codex-instances');
+            authPath = path.join(instancesDir, profile, 'auth.json');
+        }
+        if (!fs.existsSync(authPath))
+            return null;
+        const raw = fs.readFileSync(authPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        const tokens = parsed.tokens;
+        if (!tokens)
+            return null;
+        const accessToken = tokens.access_token;
+        const accountId = tokens.account_id;
+        if (typeof accessToken !== 'string' || !accessToken)
+            return null;
+        return {
+            accessToken,
+            accountId: typeof accountId === 'string' ? accountId : '',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * List all Claude profiles from the profile registry (merged legacy + unified).
+ * Returns [] on any read error so the collector degrades gracefully.
+ */
+function listClaudeProfilesFromDisk() {
+    try {
+        // Import lazily inside function to avoid circular dep and DI override in tests
+        const { ProfileRegistry } = require('../../auth/profile-registry');
+        const registry = new ProfileRegistry();
+        const profiles = Object.keys(registry.getAllProfilesMerged());
+        // Add the bare `ccs` default login (DEFAULT_PROFILE) when ~/.claude exists --
+        // the default way of running `ccs`, distinct from named `ccs <profile>`
+        // profiles. unshift so it leads before alphabetical sorting downstream.
+        if (fs.existsSync(path.join(os.homedir(), '.claude'))) {
+            if (!profiles.includes(DEFAULT_PROFILE))
+                profiles.unshift(DEFAULT_PROFILE);
+        }
+        return profiles;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Resolve the default Claude profile. A registry-designated default wins;
+ * otherwise the bare ~/.claude login (DEFAULT_PROFILE) is the default `ccs`.
+ */
+function getDefaultClaudeProfileFromDisk() {
+    try {
+        const { ProfileRegistry } = require('../../auth/profile-registry');
+        const registry = new ProfileRegistry();
+        const reg = registry.getDefaultResolved();
+        if (reg)
+            return reg;
+    }
+    catch {
+        // fall through to the bare default below
+    }
+    if (fs.existsSync(path.join(os.homedir(), '.claude')))
+        return DEFAULT_PROFILE;
+    return null;
+}
+/**
+ * List all Codex profiles from the registry, plus DEFAULT_PROFILE when the bare
+ * ~/.codex/auth.json exists. Returns [] on any read error.
+ */
+function listCodexProfilesFromDisk() {
+    try {
+        const { CodexProfileRegistry } = require('../../codex-auth/codex-profile-registry');
+        const registry = new CodexProfileRegistry();
+        const pausedIdentities = getPausedCodexAccountIdentities();
+        const profiles = registry
+            .listProfiles()
+            .filter((name) => !codexProfileMatchesPausedAccount(name, registry.getProfile(name), pausedIdentities));
+        // Add the bare ~/.codex/auth.json (the default `ccsx` invocation) as the
+        // DEFAULT_PROFILE account when it exists. It is the "default way of running",
+        // distinct from named `ccsx <profile>` profiles.
+        if (fs.existsSync(path.join(os.homedir(), '.codex', 'auth.json'))) {
+            if (!profiles.includes(DEFAULT_PROFILE))
+                profiles.push(DEFAULT_PROFILE);
+        }
+        return profiles;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Resolve the default Codex profile. Falls back to DEFAULT_PROFILE when the bare
+ * ~/.codex/auth.json exists and no registry default is set.
+ */
+function getDefaultCodexProfileFromDisk() {
+    try {
+        const { CodexProfileRegistry } = require('../../codex-auth/codex-profile-registry');
+        const registry = new CodexProfileRegistry();
+        const pausedIdentities = getPausedCodexAccountIdentities();
+        const def = registry.getDefault();
+        if (def && !codexProfileMatchesPausedAccount(def, registry.getProfile(def), pausedIdentities)) {
+            return def;
+        }
+        const fallback = registry
+            .listProfiles()
+            .find((name) => !codexProfileMatchesPausedAccount(name, registry.getProfile(name), pausedIdentities));
+        if (fallback)
+            return fallback;
+        // Fall back to the bare ~/.codex account (DEFAULT_PROFILE) when no registry
+        // default is set — it is the default `ccsx` invocation.
+        if (fs.existsSync(path.join(os.homedir(), '.codex', 'auth.json')))
+            return DEFAULT_PROFILE;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function getPausedCodexAccountIdentities() {
+    try {
+        const accounts = (0, query_1.getProviderAccounts)('codex');
+        if (accounts.length === 0)
+            return null;
+        const identities = new Set();
+        for (const account of accounts) {
+            if (!account.paused)
+                continue;
+            identities.add(account.id);
+            if (account.email)
+                identities.add(account.email);
+        }
+        return identities;
+    }
+    catch {
+        return null;
+    }
+}
+function codexProfileMatchesPausedAccount(profileName, profile, pausedIdentities) {
+    if (!pausedIdentities || pausedIdentities.size === 0)
+        return false;
+    return [profileName, profile.email, profile.account_id].some((identity) => typeof identity === 'string' && pausedIdentities.has(identity));
+}
+// ============================================================================
+// Per-profile collectors with full safety controls
+// ============================================================================
+/**
+ * Tag a row with whether it is the surface's default profile (drives the
+ * "active" badge only). The row's own `paused` flag is authoritative for
+ * dimming: live/default rows arrive with paused:false, while non-default
+ * profiles are served cache-only and dimmed to avoid live-refresh fan-out.
+ */
+function buildParkedClaudeProfileRow(profile, now) {
+    return {
+        account_id: `${SURFACE_CLAUDE}:${profile}`,
+        provider: CLAUDE_NATIVE_PROVIDER,
+        surface: SURFACE_CLAUDE,
+        profile,
+        is_subscription: true,
+        displayName: profile,
+        tier: null,
+        paused: true,
+        quota_percentage: null,
+        quotaStatus: 'unsupported',
+        next_reset: null,
+        is_default: false,
+        last_activity_at: null,
+        today_cost: null,
+        health: 'ok',
+        cached: false,
+        fetchedAt: new Date(now).toISOString(),
+        needsReauth: true,
+    };
+}
+function buildParkedCodexProfileRow(profile, now) {
+    return {
+        account_id: `${SURFACE_CODEX}:${profile}`,
+        provider: CODEX_NATIVE_PROVIDER,
+        surface: SURFACE_CODEX,
+        profile,
+        is_subscription: true,
+        displayName: profile,
+        tier: null,
+        paused: true,
+        quota_percentage: null,
+        quotaStatus: 'unsupported',
+        next_reset: null,
+        is_default: false,
+        last_activity_at: null,
+        today_cost: null,
+        health: 'ok',
+        cached: false,
+        fetchedAt: new Date(now).toISOString(),
+        needsReauth: true,
+    };
+}
+function collectCachedOrParkedProfileRow(map, profile, now, buildParkedRow) {
+    const state = getState(map, profile);
+    if (state.cachedRow) {
+        return { ...state.cachedRow, cached: true, paused: true };
+    }
+    const parkedRow = buildParkedRow(profile, now);
+    state.cachedRow = parkedRow;
+    state.cachedAt = now;
+    return parkedRow;
+}
+function markDefault(row, isDefault) {
+    return { ...row, is_default: isDefault };
+}
+/**
+ * Tag the row with is_default AND write the flag back onto the cached copy. The
+ * collector caches a row before the default profile is known (the default is
+ * resolved in the enumerator), so without this the cache-fallback path
+ * (getCachedNativeAccountRows) would serve the default account with
+ * is_default:false and the UI would stop ordering/tagging it as the default.
+ */
+function markDefaultAndSyncCache(map, profile, row, isDefault) {
+    const state = map.get(profile);
+    const marked = markDefault(row, isDefault);
+    if (state?.cachedRow) {
+        state.cachedRow = { ...state.cachedRow, is_default: isDefault };
+    }
+    return marked;
+}
+async function collectClaudeRowForProfile(profile, deps, force = false) {
+    const now = (deps.now ?? Date.now)();
+    const state = getState(claudeProfileStates, profile);
+    // Serve from cache while within TTL — force bypasses the short-circuit. Parked
+    // rows (no creds -> quotaStatus 'unsupported') use a short TTL so a fresh login
+    // is picked up within seconds instead of staying dimmed for the full quota TTL.
+    if (!force && state.cachedRow) {
+        const ttl = state.cachedRow.quotaStatus === 'unsupported' ? PARKED_TTL_MS : NATIVE_QUOTA_TTL_MS;
+        if (now - state.cachedAt < ttl)
+            return serveCached(state);
+    }
+    // Breaker open or cooldown active -> zero network, serve stale (may be null).
+    // Force does NOT bypass the breaker — it protects the account.
+    if (now < state.breakerOpenUntil || now < state.cooldownUntil) {
+        return serveCached(state);
+    }
+    // Coalesce: concurrent callers past TTL share one in-flight fetch.
+    if (state.pending) {
+        return state.pending;
+    }
+    // For per-profile reads: use the injected seam (file-only, no keychain).
+    const readDefaultCredentials = deps.readCredentials ?? claude_native_credentials_1.readClaudeCredentials;
+    const readCreds = deps.readClaudeCredentialsForProfile ??
+        ((p) => readClaudeCredentialsForProfileFromDisk(p, readDefaultCredentials));
+    const fetchQuota = deps.fetchClaudeQuota ?? quota_fetcher_claude_1.fetchClaudeQuotaWithToken;
+    const sleep = deps.sleep ?? defaultSleep;
+    state.pending = (async () => {
+        try {
+            // Yield once so the `state.pending = (...)()` assignment above completes
+            // before any synchronous return below runs the finally that nulls it.
+            // Without this, a sync return (e.g. the no-creds parked path) clears
+            // pending DURING assignment, leaving a stale resolved promise that the
+            // next call's coalescing check would return instead of re-evaluating.
+            await Promise.resolve();
+            const creds = readCreds(profile);
+            // No credentials file found -> emit parked row (needs auth, file absent).
+            // This is the expected case when the profile exists in the registry but the
+            // user has not logged in via 'ccs auth' for this machine or the credentials
+            // are stored only in keychain (which we deliberately do not access here).
+            if (!creds) {
+                const parkedRow = buildParkedClaudeProfileRow(profile, now);
+                // Cache the parked row so repeated calls don't re-stat the fs.
+                state.cachedRow = parkedRow;
+                state.cachedAt = now;
+                return parkedRow;
+            }
+            // No token / unsupported subscription -> never spend a call, omit the row.
+            if (!(0, claude_native_credentials_1.hasSupportedSubscription)(creds)) {
+                return serveCached(state);
+            }
+            const token = (0, claude_native_credentials_1.getAccessToken)(creds);
+            if (!token) {
+                return serveCached(state);
+            }
+            const tier = (0, claude_native_credentials_1.getSubscriptionTier)(creds);
+            const quota = await fetchQuota(token, `${SURFACE_CLAUDE}:${profile}`);
+            if (quota.success) {
+                // Success closes the breaker and clears backoff.
+                state.consecutive429 = 0;
+                state.breakerOpenUntil = 0;
+                state.cooldownUntil = 0;
+                state.backoffAttempt = 0;
+                const row = buildClaudeRow(quota, tier, now, SURFACE_CLAUDE, profile);
+                state.cachedRow = row;
+                state.cachedAt = now;
+                return { ...row, cached: false };
+            }
+            // 401 -> token expired. Emit a dimmed reauth row so the bar can prompt.
+            // Cache it and open a cooldown so the expired account is NOT re-polled
+            // (and re-401'd) on every refresh; it re-checks after REAUTH_COOLDOWN_MS,
+            // picking up a successful re-auth.
+            if (quota.needsReauth) {
+                const row = {
+                    account_id: `${SURFACE_CLAUDE}:${profile}`,
+                    provider: CLAUDE_NATIVE_PROVIDER,
+                    surface: SURFACE_CLAUDE,
+                    profile,
+                    is_subscription: true,
+                    displayName: profile,
+                    tier,
+                    paused: true,
+                    quota_percentage: null,
+                    quotaStatus: 'error',
+                    next_reset: null,
+                    is_default: false,
+                    last_activity_at: null,
+                    today_cost: null,
+                    health: 'error',
+                    cached: false,
+                    fetchedAt: new Date(now).toISOString(),
+                    needsReauth: true,
+                };
+                state.cachedRow = row;
+                state.cachedAt = now;
+                state.cooldownUntil = now + REAUTH_COOLDOWN_MS;
+                return { ...row, cached: false };
+            }
+            // 429 / 5xx / transient. Apply backoff + breaker, then serve stale.
+            const is429 = quota.httpStatus === 429;
+            if (is429) {
+                state.consecutive429 += 1;
+                if (state.consecutive429 >= CB_TRIP_THRESHOLD) {
+                    state.breakerOpenUntil = now + CB_COOLDOWN_MS;
+                }
+                const retryAfter = parseRetryAfterMs(quota.errorDetail, now);
+                const backoff = retryAfter ?? computeBackoffMs(state.backoffAttempt);
+                state.cooldownUntil = now + backoff;
+                state.backoffAttempt += 1;
+                // We do NOT sleep-then-retry inside the request path (that would burn
+                // the request budget). The cooldown gates the NEXT call instead.
+                void sleep; // retained as an injectable seam for future inline retry
+            }
+            else if (quota.retryable) {
+                const backoff = computeBackoffMs(state.backoffAttempt);
+                state.cooldownUntil = now + backoff;
+                state.backoffAttempt += 1;
+            }
+            // Serve last good row on failure; omit if we never succeeded.
+            return serveCached(state);
+        }
+        catch {
+            // Network/parse rejection -> treat as transient, serve stale.
+            const backoff = computeBackoffMs(state.backoffAttempt);
+            state.cooldownUntil = now + backoff;
+            state.backoffAttempt += 1;
+            return serveCached(state);
+        }
+        finally {
+            state.pending = null;
+        }
+    })();
+    return state.pending;
+}
+async function collectCodexRowForProfile(profile, deps, force = false) {
+    const now = (deps.now ?? Date.now)();
+    const state = getState(codexProfileStates, profile);
+    // Serve from cache while within TTL — force bypasses the short-circuit. Parked
+    // rows (no auth -> quotaStatus 'unsupported') use a short TTL so a fresh login
+    // is picked up within seconds instead of staying dimmed for the full quota TTL.
+    if (!force && state.cachedRow) {
+        const ttl = state.cachedRow.quotaStatus === 'unsupported' ? PARKED_TTL_MS : NATIVE_QUOTA_TTL_MS;
+        if (now - state.cachedAt < ttl)
+            return serveCached(state);
+    }
+    // Breaker open or cooldown active -> skip network, go to LOCAL fallback.
+    // Force does NOT bypass the breaker — it protects the account.
+    const breakerOrCooldownActive = now < state.breakerOpenUntil || now < state.cooldownUntil;
+    // Coalesce: concurrent callers past TTL share one in-flight resolution.
+    if (state.pending) {
+        return state.pending;
+    }
+    // Resolve the native auth for this profile to get a network accountId.
+    const readNativeAuth = deps.readCodexNativeAuth ?? ((p) => readCodexNativeAuthFromDisk(p));
+    // For the network fallback: the legacy getDefaultCodexAccountId is the
+    // CLIProxy-registry path; for native profiles we use the on-disk auth directly.
+    const fetchNetwork = deps.fetchCodexNetworkQuota ?? ((accountId) => (0, quota_fetcher_codex_1.fetchCodexQuota)(accountId));
+    const getCodex = deps.getCodexQuota ?? codex_local_quota_collector_1.getCodexLocalQuota;
+    const sleep = deps.sleep ?? defaultSleep;
+    state.pending = (async () => {
+        try {
+            // Yield once so the `state.pending = (...)()` assignment completes before
+            // any synchronous return below runs the finally that nulls it (otherwise a
+            // sync return leaves a stale resolved promise the next call would reuse).
+            await Promise.resolve();
+            // ----------------------------------------------------------------
+            // PRIMARY: live network fetch (skipped when breaker/cooldown active)
+            // ----------------------------------------------------------------
+            if (!breakerOrCooldownActive) {
+                const nativeAuth = readNativeAuth(profile);
+                // Use the on-disk accountId for the network call; fall through to local
+                // when the auth file is absent (parked profile).
+                if (nativeAuth) {
+                    const quota = await fetchNetwork(nativeAuth.accountId || profile);
+                    if (quota.success) {
+                        // A healthy response closes the breaker and clears backoff,
+                        // regardless of content.
+                        state.consecutive429 = 0;
+                        state.breakerOpenUntil = 0;
+                        state.cooldownUntil = 0;
+                        state.backoffAttempt = 0;
+                        // At least one core window (5h/weekly) resolved -> full quota row.
+                        if (quota.coreUsage?.fiveHour || quota.coreUsage?.weekly) {
+                            const row = buildCodexNetworkRow(quota, now, SURFACE_CODEX, profile);
+                            state.cachedRow = row;
+                            state.cachedAt = now;
+                            return { ...row, cached: false };
+                        }
+                        // Success but no core window. The token authenticated, so this is a
+                        // VALID active subscription with a sparse payload — emit an active
+                        // (quota-less) row instead of parking it. Only the bare default keeps
+                        // falling through to the global local session data below.
+                        if (profile !== DEFAULT_PROFILE) {
+                            const row = buildCodexNetworkRow(quota, now, SURFACE_CODEX, profile);
+                            state.cachedRow = row;
+                            state.cachedAt = now;
+                            return { ...row, cached: false };
+                        }
+                        // else (default): fall through to LOCAL fallback below.
+                    }
+                    else if (quota.needsReauth) {
+                        // Token expired -> dimmed reauth row. Cache it and cool down so the
+                        // expired account is NOT re-polled (and re-401'd) every refresh; it
+                        // re-checks after REAUTH_COOLDOWN_MS to pick up a re-auth.
+                        const reauthRow = {
+                            account_id: `${SURFACE_CODEX}:${profile}`,
+                            provider: CODEX_NATIVE_PROVIDER,
+                            surface: SURFACE_CODEX,
+                            profile,
+                            is_subscription: true,
+                            displayName: profile,
+                            tier: null,
+                            paused: true,
+                            quota_percentage: null,
+                            quotaStatus: 'error',
+                            next_reset: null,
+                            is_default: false,
+                            last_activity_at: null,
+                            today_cost: null,
+                            health: 'error',
+                            cached: false,
+                            fetchedAt: new Date(now).toISOString(),
+                            needsReauth: true,
+                        };
+                        state.cachedRow = reauthRow;
+                        state.cachedAt = now;
+                        state.cooldownUntil = now + REAUTH_COOLDOWN_MS;
+                        return { ...reauthRow, cached: false };
+                    }
+                    else if (quota.httpStatus === 429) {
+                        // 429: apply breaker + backoff, then fall through to local.
+                        state.consecutive429 += 1;
+                        if (state.consecutive429 >= CB_TRIP_THRESHOLD) {
+                            state.breakerOpenUntil = now + CB_COOLDOWN_MS;
+                        }
+                        const retryAfter = parseRetryAfterMs(quota.errorDetail, now);
+                        const backoff = retryAfter ?? computeBackoffMs(state.backoffAttempt);
+                        state.cooldownUntil = now + backoff;
+                        state.backoffAttempt += 1;
+                        void sleep; // retained as an injectable seam for future inline retry
+                    }
+                    else if (quota.retryable) {
+                        // Other transient failure: set cooldown, fall through to local.
+                        const backoff = computeBackoffMs(state.backoffAttempt);
+                        state.cooldownUntil = now + backoff;
+                        state.backoffAttempt += 1;
+                    }
+                    else {
+                        // Terminal non-retryable failure (e.g. 403/404): back off so we
+                        // don't re-hit a dead endpoint every poll when no local data caches
+                        // a row to engage the TTL short-circuit. Then fall through to local.
+                        const backoff = computeBackoffMs(state.backoffAttempt);
+                        state.cooldownUntil = now + backoff;
+                        state.backoffAttempt += 1;
+                    }
+                    // Fall through to LOCAL fallback below.
+                }
+                // No on-disk auth for this profile -> fall through to the fallback below.
+            }
+            // ----------------------------------------------------------------
+            // LOCAL FALLBACK: session-log read (zero network). The session logs live
+            // in the GLOBAL ~/.codex, so they represent ONLY the bare default account,
+            // never a named profile. Using them for a named profile would misattribute
+            // the default's usage to the profile, so only the default falls back to
+            // local; named profiles park instead.
+            // ----------------------------------------------------------------
+            if (profile === DEFAULT_PROFILE) {
+                const localQuota = await getCodex();
+                if (localQuota) {
+                    const row = buildCodexRow(localQuota, now, SURFACE_CODEX, profile);
+                    state.cachedRow = row;
+                    state.cachedAt = now;
+                    return { ...row, cached: false };
+                }
+            }
+            // Named profile (or default with no local data): serve the last-known row
+            // if any, else a dimmed parked row -- never global local data for a named
+            // profile.
+            const stale = serveCached(state);
+            if (stale)
+                return stale;
+            const parkedRow = buildParkedCodexProfileRow(profile, now);
+            state.cachedRow = parkedRow;
+            state.cachedAt = now;
+            return parkedRow;
+        }
+        catch {
+            // Network/parse rejection -> treat as transient, serve stale.
+            const backoff = computeBackoffMs(state.backoffAttempt);
+            state.cooldownUntil = now + backoff;
+            state.backoffAttempt += 1;
+            return serveCached(state);
+        }
+        finally {
+            state.pending = null;
+        }
+    })();
+    return state.pending;
+}
+// ============================================================================
+// Legacy single-profile collectors (unchanged; used by old tests + back-compat)
+// ============================================================================
+/**
+ * @deprecated Use collectClaudeRowForProfile with the 'default' or appropriate
+ * profile name. Kept for backward compatibility with existing tests that stub
+ * readCredentials/getDefaultCodexAccountId directly.
+ */
 async function collectClaudeRow(deps, force = false) {
     const now = (deps.now ?? Date.now)();
-    const state = claudeState;
+    // Use the legacy single-state approach via profile key '__legacy__' to avoid
+    // breaking state isolation with the per-profile maps.
+    const state = getState(claudeProfileStates, '__legacy__');
     // Serve from cache while within TTL — force bypasses TTL short-circuit.
     if (!force && state.cachedRow && now - state.cachedAt < NATIVE_QUOTA_TTL_MS) {
         return serveCached(state);
     }
     // Breaker open or cooldown active -> zero network, serve stale (may be null).
-    // Force does NOT bypass the breaker — it protects the account.
     if (now < state.breakerOpenUntil || now < state.cooldownUntil) {
         return serveCached(state);
     }
@@ -320,12 +981,12 @@ async function collectClaudeRow(deps, force = false) {
     if (state.pending) {
         return state.pending;
     }
-    const readCredentials = deps.readCredentials ?? claude_native_credentials_1.readClaudeCredentials;
+    const readCredentialsFn = deps.readCredentials ?? claude_native_credentials_1.readClaudeCredentials;
     const fetchQuota = deps.fetchClaudeQuota ?? quota_fetcher_claude_1.fetchClaudeQuotaWithToken;
     const sleep = deps.sleep ?? defaultSleep;
     state.pending = (async () => {
         try {
-            const creds = readCredentials();
+            const creds = readCredentialsFn();
             // No token / unsupported subscription -> never spend a call, omit the row.
             if (!creds || !(0, claude_native_credentials_1.hasSupportedSubscription)(creds)) {
                 return serveCached(state);
@@ -342,13 +1003,12 @@ async function collectClaudeRow(deps, force = false) {
                 state.breakerOpenUntil = 0;
                 state.cooldownUntil = 0;
                 state.backoffAttempt = 0;
-                const row = buildClaudeRow(quota, tier, now);
+                const row = buildClaudeRowLegacy(quota, tier, now);
                 state.cachedRow = row;
                 state.cachedAt = now;
                 return { ...row, cached: false };
             }
-            // 401 -> token expired. Emit a reauth row so the bar can prompt; this is
-            // a real, actionable state distinct from a transient failure.
+            // 401 -> token expired.
             if (quota.needsReauth) {
                 const row = {
                     account_id: CLAUDE_PROVIDER,
@@ -367,11 +1027,9 @@ async function collectClaudeRow(deps, force = false) {
                     fetchedAt: new Date(now).toISOString(),
                     needsReauth: true,
                 };
-                // Do not cache the reauth row as a good value; it should re-evaluate
-                // once the user re-auths. But return it now.
                 return row;
             }
-            // 429 / 5xx / transient. Apply backoff + breaker, then serve stale.
+            // 429 / 5xx / transient.
             const is429 = quota.httpStatus === 429;
             if (is429) {
                 state.consecutive429 += 1;
@@ -382,20 +1040,16 @@ async function collectClaudeRow(deps, force = false) {
                 const backoff = retryAfter ?? computeBackoffMs(state.backoffAttempt);
                 state.cooldownUntil = now + backoff;
                 state.backoffAttempt += 1;
-                // We do NOT sleep-then-retry inside the request path (that would burn
-                // the request budget). The cooldown gates the NEXT call instead.
-                void sleep; // retained as an injectable seam for future inline retry
+                void sleep;
             }
             else if (quota.retryable) {
                 const backoff = computeBackoffMs(state.backoffAttempt);
                 state.cooldownUntil = now + backoff;
                 state.backoffAttempt += 1;
             }
-            // Serve last good row on failure; omit if we never succeeded.
             return serveCached(state);
         }
         catch {
-            // Network/parse rejection -> treat as transient, serve stale.
             const backoff = computeBackoffMs(state.backoffAttempt);
             state.cooldownUntil = now + backoff;
             state.backoffAttempt += 1;
@@ -407,18 +1061,40 @@ async function collectClaudeRow(deps, force = false) {
     })();
     return state.pending;
 }
-// ============================================================================
-// Codex path with live network as PRIMARY, local logs as FALLBACK
-// ============================================================================
+/** Legacy row builder — no surface/profile/is_subscription fields. */
+function buildClaudeRowLegacy(quota, tier, now) {
+    const quotaWindows = buildClaudeQuotaWindows(quota);
+    return {
+        account_id: CLAUDE_PROVIDER,
+        provider: CLAUDE_PROVIDER,
+        displayName: 'Claude Code',
+        tier,
+        paused: false,
+        quota_percentage: deriveClaudeQuotaPercentage(quota),
+        quotaStatus: 'ok',
+        next_reset: deriveClaudeNextReset(quota),
+        is_default: false,
+        last_activity_at: null,
+        today_cost: null,
+        health: 'ok',
+        cached: false,
+        fetchedAt: new Date(now).toISOString(),
+        needsReauth: false,
+        ...(quotaWindows.length > 0 ? { quotaWindows } : {}),
+    };
+}
+/**
+ * Legacy Codex collector — uses the old getDefaultCodexAccountId dep.
+ * Kept for backward compatibility with existing tests.
+ */
 async function collectCodexRow(deps, force = false) {
     const now = (deps.now ?? Date.now)();
-    const state = codexState;
+    const state = getState(codexProfileStates, '__legacy__');
     // Serve from cache while within TTL — force bypasses TTL short-circuit.
     if (!force && state.cachedRow && now - state.cachedAt < NATIVE_QUOTA_TTL_MS) {
         return serveCached(state);
     }
     // Breaker open or cooldown active -> skip network, go to LOCAL fallback.
-    // Force does NOT bypass the breaker — it protects the account.
     const breakerOrCooldownActive = now < state.breakerOpenUntil || now < state.cooldownUntil;
     // Coalesce: concurrent callers past TTL share one in-flight resolution.
     if (state.pending) {
@@ -430,6 +1106,10 @@ async function collectCodexRow(deps, force = false) {
     const sleep = deps.sleep ?? defaultSleep;
     state.pending = (async () => {
         try {
+            // Yield once so the `state.pending = (...)()` assignment completes before
+            // any synchronous return below runs the finally that nulls it (otherwise a
+            // sync return leaves a stale resolved promise the next call would reuse).
+            await Promise.resolve();
             // ----------------------------------------------------------------
             // PRIMARY: live network fetch (skipped when breaker/cooldown active)
             // ----------------------------------------------------------------
@@ -438,19 +1118,12 @@ async function collectCodexRow(deps, force = false) {
                 if (accountId) {
                     const quota = await fetchNetwork(accountId);
                     if (quota.success) {
-                        // A healthy response closes the breaker and clears backoff,
-                        // regardless of content.
                         state.consecutive429 = 0;
                         state.breakerOpenUntil = 0;
                         state.cooldownUntil = 0;
                         state.backoffAttempt = 0;
-                        // Only usable when at least one core window (5h/weekly) resolved. A
-                        // success with empty coreUsage (only code-review/additional windows,
-                        // or a changed payload) carries no glanceable signal — do NOT cache
-                        // a contentless "ok" row or clobber a good cache; fall through to
-                        // the local fallback so the bar shows real data instead.
                         if (quota.coreUsage?.fiveHour || quota.coreUsage?.weekly) {
-                            const row = buildCodexNetworkRow(quota, now);
+                            const row = buildCodexNetworkRowLegacy(quota, now);
                             state.cachedRow = row;
                             state.cachedAt = now;
                             return { ...row, cached: false };
@@ -458,7 +1131,6 @@ async function collectCodexRow(deps, force = false) {
                         // else: fall through to LOCAL fallback below.
                     }
                     else if (quota.needsReauth) {
-                        // Token expired -> reauth row; do NOT cache as a good value.
                         return {
                             account_id: CODEX_PROVIDER,
                             provider: CODEX_PROVIDER,
@@ -478,7 +1150,6 @@ async function collectCodexRow(deps, force = false) {
                         };
                     }
                     else if (quota.httpStatus === 429) {
-                        // 429: apply breaker + backoff, then fall through to local.
                         state.consecutive429 += 1;
                         if (state.consecutive429 >= CB_TRIP_THRESHOLD) {
                             state.breakerOpenUntil = now + CB_COOLDOWN_MS;
@@ -487,42 +1158,34 @@ async function collectCodexRow(deps, force = false) {
                         const backoff = retryAfter ?? computeBackoffMs(state.backoffAttempt);
                         state.cooldownUntil = now + backoff;
                         state.backoffAttempt += 1;
-                        void sleep; // retained as an injectable seam for future inline retry
+                        void sleep;
                     }
                     else if (quota.retryable) {
-                        // Other transient failure: set cooldown, fall through to local.
                         const backoff = computeBackoffMs(state.backoffAttempt);
                         state.cooldownUntil = now + backoff;
                         state.backoffAttempt += 1;
                     }
                     else {
-                        // Terminal non-retryable failure (e.g. 403/404): back off so we
-                        // don't re-hit a dead endpoint every poll when no local data caches
-                        // a row to engage the TTL short-circuit. Then fall through to local.
                         const backoff = computeBackoffMs(state.backoffAttempt);
                         state.cooldownUntil = now + backoff;
                         state.backoffAttempt += 1;
                     }
                     // Fall through to LOCAL fallback below.
                 }
-                // No configured accountId -> fall through to local fallback.
             }
             // ----------------------------------------------------------------
-            // LOCAL FALLBACK: session log read (zero network, always attempted
-            // when network is unavailable / no accountId / breaker active)
+            // LOCAL FALLBACK
             // ----------------------------------------------------------------
             const localQuota = await getCodex();
             if (localQuota) {
-                const row = buildCodexRow(localQuota, now);
+                const row = buildCodexRowLegacy(localQuota, now);
                 state.cachedRow = row;
                 state.cachedAt = now;
                 return { ...row, cached: false };
             }
-            // No local data either: serve stale (may be null).
             return serveCached(state);
         }
         catch {
-            // Network/parse rejection -> treat as transient, serve stale.
             const backoff = computeBackoffMs(state.backoffAttempt);
             state.cooldownUntil = now + backoff;
             state.backoffAttempt += 1;
@@ -534,21 +1197,120 @@ async function collectCodexRow(deps, force = false) {
     })();
     return state.pending;
 }
+/** Legacy Codex row builder (local quota). */
+function buildCodexRowLegacy(quota, now) {
+    const quotaWindows = buildCodexQuotaWindows(quota);
+    return {
+        account_id: CODEX_PROVIDER,
+        provider: CODEX_PROVIDER,
+        displayName: 'Codex',
+        tier: quota.tier,
+        paused: false,
+        quota_percentage: quota.quotaPercentage,
+        quotaStatus: 'ok',
+        next_reset: quota.nextReset,
+        is_default: false,
+        last_activity_at: null,
+        today_cost: null,
+        health: quota.stale ? 'warning' : 'ok',
+        cached: false,
+        fetchedAt: new Date(now).toISOString(),
+        needsReauth: false,
+        ...(quotaWindows.length > 0 ? { quotaWindows } : {}),
+        ...(quota.staleAsOf ? { staleAsOf: quota.staleAsOf } : {}),
+    };
+}
+/** Legacy Codex network row builder. */
+function buildCodexNetworkRowLegacy(quota, now) {
+    const windows = [];
+    const fiveHour = quota.coreUsage?.fiveHour;
+    if (fiveHour) {
+        windows.push({
+            key: 'five_hour',
+            label: '5h',
+            usedPercent: 100 - fiveHour.remainingPercent,
+            remainingPercent: fiveHour.remainingPercent,
+            resetAt: fiveHour.resetAt,
+            windowMinutes: FIVE_HOUR_MINUTES,
+        });
+    }
+    const weekly = quota.coreUsage?.weekly;
+    if (weekly) {
+        windows.push({
+            key: 'seven_day',
+            label: 'week',
+            usedPercent: 100 - weekly.remainingPercent,
+            remainingPercent: weekly.remainingPercent,
+            resetAt: weekly.resetAt,
+            windowMinutes: SEVEN_DAY_MINUTES,
+        });
+    }
+    const coreWindows = [fiveHour, weekly].filter((w) => !!w);
+    const quotaPercentage = coreWindows.length > 0 ? Math.min(...coreWindows.map((w) => w.remainingPercent)) : null;
+    const resets = coreWindows
+        .map((w) => w.resetAt)
+        .filter((r) => typeof r === 'string')
+        .map((r) => ({ iso: r, ms: new Date(r).getTime() }))
+        .filter((r) => Number.isFinite(r.ms))
+        .sort((a, b) => a.ms - b.ms);
+    const nextReset = resets.length > 0 ? resets[0].iso : null;
+    return {
+        account_id: CODEX_PROVIDER,
+        provider: CODEX_PROVIDER,
+        displayName: 'Codex',
+        tier: quota.planType ?? null,
+        paused: false,
+        quota_percentage: quotaPercentage,
+        quotaStatus: 'ok',
+        next_reset: nextReset,
+        is_default: false,
+        last_activity_at: null,
+        today_cost: null,
+        health: 'ok',
+        cached: false,
+        fetchedAt: new Date(now).toISOString(),
+        needsReauth: false,
+        ...(windows.length > 0 ? { quotaWindows: windows } : {}),
+    };
+}
 // ============================================================================
 // Public entry point
 // ============================================================================
 /**
- * Build the native subscription rows (Claude Code + Codex) for /summary.
+ * Build the native subscription rows for /summary.
+ *
+ * When profile-enumeration deps are injected (listClaudeProfiles / listCodexProfiles
+ * etc.), all profiles are enumerated and the active/default profile is live-polled
+ * while non-default profiles are cache-only (parked). This keeps the 2.5s deadline:
+ * at most 2 live upstream calls per /summary regardless of profile count.
  *
- * Each path is independently try/caught so one failing source never blocks the
- * other or the response. Returns only rows that represent real data.
+ * When no enumeration deps are injected (legacy mode / old tests that stub only
+ * readCredentials + getDefaultCodexAccountId), the old single-profile collectors
+ * are used for backward compatibility.
  *
- * `opts.force` bypasses the TTL short-circuit on both paths so a debounce-
- * passing refresh re-pulls native rows live. The circuit breaker is always
- * respected regardless of force (account protection).
+ * `opts.force` bypasses the TTL short-circuit on the ACTIVE profile. The circuit
+ * breaker is always respected regardless of force (account protection).
  */
 async function getNativeAccountRows(deps = {}, opts) {
     const force = opts?.force ?? false;
+    // Multi-profile enumeration is the DEFAULT (production) behavior. The legacy
+    // single-profile path is retained ONLY for backward-compat with old tests that
+    // inject readCredentials / getDefaultCodexAccountId and assert the original
+    // single-row output. Those harnesses never inject the enumeration seams; the
+    // new multi-profile tests pair both seams, and production injects neither — so
+    // everything except the legacy harness takes the multi-profile path below.
+    const hasProfileEnumeration = deps.listClaudeProfiles !== undefined ||
+        deps.listCodexProfiles !== undefined ||
+        deps.defaultClaudeProfile !== undefined ||
+        deps.defaultCodexProfile !== undefined;
+    const isLegacyTestHarness = !hasProfileEnumeration &&
+        (deps.readCredentials !== undefined || deps.getDefaultCodexAccountId !== undefined);
+    if (!isLegacyTestHarness) {
+        return getNativeAccountRowsMultiProfile(deps, force);
+    }
+    // Legacy path: backward-compatible with old tests that only inject
+    // readCredentials / getDefaultCodexAccountId. Produces the old single-row
+    // output (account_id='claude-code'/'codex', no surface/profile).
     const [claude, codex] = await Promise.all([
         collectClaudeRow(deps, force).catch(() => null),
         collectCodexRow(deps, force).catch(() => null),
@@ -561,6 +1323,79 @@ async function getNativeAccountRows(deps = {}, opts) {
     return rows;
 }
 exports.getNativeAccountRows = getNativeAccountRows;
+async function getNativeAccountRowsMultiProfile(deps, force) {
+    const listClaude = deps.listClaudeProfiles ?? listClaudeProfilesFromDisk;
+    const listCodex = deps.listCodexProfiles ?? listCodexProfilesFromDisk;
+    const defaultClaude = deps.defaultClaudeProfile ?? getDefaultClaudeProfileFromDisk;
+    const defaultCodex = deps.defaultCodexProfile ?? getDefaultCodexProfileFromDisk;
+    const claudeProfiles = (() => {
+        try {
+            return listClaude();
+        }
+        catch {
+            return [];
+        }
+    })();
+    const codexProfiles = (() => {
+        try {
+            return listCodex();
+        }
+        catch {
+            return [];
+        }
+    })();
+    const claudeDefault = (() => {
+        try {
+            return defaultClaude();
+        }
+        catch {
+            return null;
+        }
+    })();
+    const codexDefault = (() => {
+        try {
+            return defaultCodex();
+        }
+        catch {
+            return null;
+        }
+    })();
+    const tasks = [];
+    const results = [];
+    const now = (deps.now ?? Date.now)();
+    // Preserve the safety budget: only the active/default profile for each surface
+    // may perform a live refresh. Non-default profiles are cache-only (or parked)
+    // so one /summary request can trigger at most one Claude and one Codex live
+    // upstream call regardless of configured profile count.
+    for (const p of claudeProfiles) {
+        const isDefault = p === claudeDefault;
+        if (!isDefault) {
+            results.push(markDefaultAndSyncCache(claudeProfileStates, p, collectCachedOrParkedProfileRow(claudeProfileStates, p, now, buildParkedClaudeProfileRow), false));
+            continue;
+        }
+        tasks.push(collectClaudeRowForProfile(p, deps, force || claudeProfileStates.get(p)?.cachedRow?.quotaStatus === 'unsupported')
+            .then((r) => (r ? markDefaultAndSyncCache(claudeProfileStates, p, r, true) : null))
+            .catch(() => null));
+    }
+    for (const p of codexProfiles) {
+        const isDefault = p === codexDefault;
+        if (!isDefault) {
+            results.push(markDefaultAndSyncCache(codexProfileStates, p, collectCachedOrParkedProfileRow(codexProfileStates, p, now, buildParkedCodexProfileRow), false));
+            continue;
+        }
+        tasks.push(collectCodexRowForProfile(p, deps, force || codexProfileStates.get(p)?.cachedRow?.quotaStatus === 'unsupported')
+            .then((r) => (r ? markDefaultAndSyncCache(codexProfileStates, p, r, true) : null))
+            .catch(() => null));
+    }
+    results.push(...(await Promise.all(tasks)));
+    const rows = results.filter((r) => r !== null);
+    // Sort by (surface, profile) for stable ordering.
+    return rows.sort((a, b) => {
+        const sa = (a.surface ?? '') + ':' + (a.profile ?? '');
+        const sb = (b.surface ?? '') + ':' + (b.profile ?? '');
+        return sa.localeCompare(sb);
+    });
+}
 /**
  * Last-known native rows from cache, WITHOUT any fetch (instant, no network).
  *
@@ -571,10 +1406,14 @@ exports.getNativeAccountRows = getNativeAccountRows;
  */
 function getCachedNativeAccountRows() {
     const rows = [];
-    if (claudeState.cachedRow)
-        rows.push({ ...claudeState.cachedRow, cached: true });
-    if (codexState.cachedRow)
-        rows.push({ ...codexState.cachedRow, cached: true });
+    for (const state of claudeProfileStates.values()) {
+        if (state.cachedRow)
+            rows.push({ ...state.cachedRow, cached: true });
+    }
+    for (const state of codexProfileStates.values()) {
+        if (state.cachedRow)
+            rows.push({ ...state.cachedRow, cached: true });
+    }
     return rows;
 }
 exports.getCachedNativeAccountRows = getCachedNativeAccountRows;