@modelprofile.com/authswitch 4.0.0 → 5.1.0

package/readme.md

@@ -187,6 +187,12 @@ authswitch uses `agl authswitch --request <json>` without an AGL package depende
 A failed or ambiguous transport never falls through to a second local mutation.
 AGL and the CLI must use matching credential locations and compatible versions.
 
+`authSwitchMutationReplacesLogin(mutation)` says whether a mutation replaces the
+harness's active login -- `switch`, or `save` without `keepActive` -- and therefore
+concerns the instances running on it. The command line, the dashboard and a host
+such as AGL all read this one rule; `remove` and a save that keeps the login
+active leave the loaded login in place.
+
 OpenCode credentials live in `${XDG_DATA_HOME:-~/.local/share}/opencode/auth.json`.
 Several providers can be active at once. Saving or switching `openai` preserves
 every other provider, and `stash openai` without `--keep` clears only OpenAI.
@@ -241,11 +247,31 @@ keeps every other field of the login, and writes the result only while the saved
 still holds the refresh token it sent. The refresh holds the account store's lock, so a
 switch started at the same time waits for it and then activates the refreshed login. The
 **active** login is never refreshed -- Claude Code owns it, and two parties refreshing one
-login can invalidate the grant. A refusal is reported, never worked around: `Login expired
-or was rejected. Log in again with Claude Code and save it.` for a rejected grant, and a
-service failure, an unreachable service or an unsupported response leave the saved login
-untouched. Requests carry `User-Agent: authswitch/<version>`, and HTTP 429 is reported as
-rate limiting with the service's retry time -- never as an exhausted or expired account.
+login can invalidate the grant. A refusal is reported, never worked around -- a rejected
+grant says so and says what fixes it (below), and a service failure, an unreachable service
+or an unsupported response leave the saved login untouched. Requests carry `User-Agent:
+authswitch/<version>`, and HTTP 429 is reported as rate limiting with the service's retry
+time -- never as an exhausted or expired account.
+
+Claude Code also rotates the refresh token of the login it **is** running on, so reading the
+accounts (`list`, `limits`, `active`, `current`, `watch`, the dashboard) mirrors that login
+into its own saved record whenever the two differ. Without it a login replaced outside
+authswitch -- a `/login` in Claude Code, a new device login -- left the stash holding the
+token from before the rotation, which the sign-in service can refuse: it did for two saved
+logins on 2026-09-18. The record keeps its account, its identity and its save time, Claude
+Code's own files are only ever read, and a login with no saved record of its own is never
+saved implicitly; `stash` is what saves a login. An installation whose native login
+authswitch cannot read mirrors nothing, and a read waits at most a second for a lock a
+switch or Claude Code holds before leaving the saved copy to the next read.
+
+A grant the sign-in service refused is remembered in the saved record itself, as a hash of
+the refresh token -- never the token -- so a new authswitch run, a restarted watch or a
+second dashboard does not replay a dead login. Saving that login again clears it, as does
+any refresh that replaces the saved credential. Such a login reports `Login expired or was
+rejected. Log in again with Claude Code and save it. Claude Code rotates a login's refresh
+token as it uses it, and the service can refuse the older one a saved copy still holds once
+that login has been replaced outside authswitch; authswitch claude stash --keep saves the
+new one.`
 
 OpenCode and Claude saved records are separate owner-only files under
 `~/.authswitch/opencode` and `~/.authswitch/claude`. Emails are accepted as account
@@ -308,7 +334,7 @@ authswitch watch --json                       # one JSON event per line
 14:02:07 Watching Claude Code, Codex every 2m; switching at 95%.
 14:02:07 Running Codex sessions keep the login they loaded; new sessions use the switched one.
 14:02:09 Claude Code alice@example.com (type:Max) (5h:17%) (w:4%) ok
-14:02:10 Codex switched bob@example.com → carol@example.com (type:Pro) (5h:3%) (w:12%) — Codex primary 96% ≥ 95%
+14:02:10 Codex switched bob@example.com → carol@example.com (type:Pro) (5h:3%) (w:12%) — Codex weekly 96% ≥ 95%
 14:04:09 Claude Code alice@example.com (type:Max) (5h:21%) (w:4%) ok
 14:04:10 Codex carol@example.com (type:Pro) (5h:4%) (w:12%) ok
 ```
@@ -481,13 +507,13 @@ Codex
 │ Plus, unverified  │ 2026-09-14 11:32 │                    │             │               │
 └───────────────────┴──────────────────┴────────────────────┴─────────────┴───────────────┘
 
-┌───────────────────┬───────────────────────┬────────┬───────────┐
-│ Account           │ Limit type            │ Used % │ Resets in │
-├───────────────────┼───────────────────────┼────────┼───────────┤
-│ alice@example.com │ Codex secondary       │    12% │     3d 4h │
-│ Pro               │ Codex primary         │    37% │    2h 13m │
-│                   │ Code review secondary │   100% │    3h 59m │
-└───────────────────┴───────────────────────┴────────┴───────────┘
+┌───────────────────┬────────────────────┬────────┬───────────┐
+│ Account           │ Limit type         │ Used % │ Resets in │
+├───────────────────┼────────────────────┼────────┼───────────┤
+│ alice@example.com │ Codex weekly       │    12% │     3d 4h │
+│ Pro               │ Codex five-hour    │    37% │    2h 13m │
+│                   │ Code review weekly │   100% │    3h 59m │
+└───────────────────┴────────────────────┴────────┴───────────┘
 
 ┌────────────────┬───────────────────┐
 │ Metric         │ alice@example.com │
@@ -549,10 +575,18 @@ has the same period; a feature limit, or a general window sharing its period, is
 named by its label (`Fable weekly 100% · 2d`). Feature limits such as Spark and code
 review appear in the Limits table and lead the usage cell only when the provider
 picks one as its headline. The TUI uses the same selection and names. Window
-durations come from the provider, not from the plan name or primary/secondary
-position; a Pro account with only a general weekly window gets no invented 5-hour
+durations come from the provider, not from the plan name or the slot a window
+arrives in; a Pro account with only a general weekly window gets no invented 5-hour
 limit.
 
+Every window label names the window by how long it is -- `Codex weekly`, `Codex
+five-hour`, `Claude weekly`, `Code review weekly` -- so the same length reads the
+same in every harness. The named lengths are `five-hour`, `daily`, `weekly`,
+`monthly` and `annual`, the same set Codex names its own windows with, and its
+primary/secondary slot is shown (`Codex weekly (secondary)`) only where two windows
+of one length would otherwise share a label. A length with no name of its own keeps
+its compact duration (`Codex 90m`) instead of reading as a period it is not.
+
 When accounts of one harness share a label, every table numbers the later ones
 (`alice@example.com (2)`), so each account keeps its own column in the Details
 comparison and reads the same everywhere. Missing data stays `n/a`; known zeroes
@@ -585,10 +619,10 @@ Account limits
 ┃                  │ Max               │ Claude five-hour  │    12% │         1h 2m │             │
 ┃                  │                   │ Fable weekly      │    88% │         2d 5h │             │
 ├──────────────────┼───────────────────┼───────────────────┼────────┼───────────────┼─────────────┤
-┃ Codex            │ alice@example.com │ Codex secondary   │    12% │         3d 4h │ 2026-10-08  │
-┃                  │ Pro               │ Codex primary     │    37% │        2h 13m │ auto-renews │
-┃                  │                   │ Code review secon │   100% │        3h 59m │             │
-┃                  │                   │ dary              │        │               │             │
+┃ Codex            │ alice@example.com │ Codex weekly      │    12% │         3d 4h │ 2026-10-08  │
+┃                  │ Pro               │ Codex five-hour   │    37% │        2h 13m │ auto-renews │
+┃                  │                   │ Code review weekl │   100% │        3h 59m │             │
+┃                  │                   │ y                 │        │               │             │
 ┃                  ├───────────────────┼───────────────────┼────────┼───────────────┼─────────────┤
 ┃                  │ bob@example.com   │ n/a               │    n/a │           n/a │ n/a         │
 ┃                  │ Plus, unverified  │                   │        │               │             │
@@ -597,7 +631,7 @@ Account limits
 ┃ opic             │  20e751c3b707     │                   │        │               │             │
 ┃                  │ n/a               │                   │        │               │             │
 ├──────────────────┼───────────────────┼───────────────────┼────────┼───────────────┼─────────────┤
-┃ OpenCode / opena │ alice@example.com │ Codex primary     │     0% │ not scheduled │ 2026-10-02  │
+┃ OpenCode / opena │ alice@example.com │ Codex five-hour   │     0% │ not scheduled │ 2026-10-02  │
 ┃ i                │ Pro               │                   │        │               │ cancels     │
 └──────────────────┴───────────────────┴───────────────────┴────────┴───────────────┴─────────────┘
 
@@ -705,8 +739,9 @@ unsaved current login adds how to keep it (`authswitch <harness> stash --keep sa
 it`).
 
 `authswitch <harness> current` prints the same sentence. The same account with a
-rotated token is that account refreshing itself and is not reported; re-running the
-switch re-arms the check against the file's current contents.
+rotated token is that account refreshing itself and is not reported; for Claude Code the
+rotation is copied into that account's saved record, and re-running the switch re-arms the
+check against the file's current contents.
 
 Both commands accept a harness qualifier (`authswitch claude limits`) and `--json`.
 Neither changes which account is in use: they never activate, switch or clear a login and
@@ -765,13 +800,13 @@ accept schema version 2 and handle null reset timestamps. Scripts should qualify
 mutation commands with `codex`, `opencode` or `claude`, since all three now register
 by default. Saved Codex credentials retain their existing format.
 
-For each ChatGPT login, Codex status includes the live plan, primary and secondary
-usage windows with remaining percentages and UTC reset times, additional limits
+For each ChatGPT login, Codex status includes the live plan, every usage window the
+service reports with remaining percentages and reset times, additional limits
 such as code review, credit availability and balance, spend limits when returned,
 earned reset availability and expiry details, lifetime and peak daily tokens,
 activity streaks, and the latest seven reported daily token totals.
 
-The Codex adapter implements the read-only GET requests used by Codex 0.154.0 at
+The Codex adapter implements the read-only GET requests used by Codex 0.155.0 at
 `chatgpt.com/backend-api/wham`: `usage`, `rate-limit-reset-credits`, and `profiles/me`.
 Billing uses `chatgpt.com/backend-api/accounts/check/v4-2023-04-27`, verified against
 the official desktop bundle 26.908.40834. It selects the exact credential account;

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: "@modelprofile.com/authswitch",
-  version: "4.0.0",
+  version: "5.1.0",
   description: "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status"
 }

package/ts/accounts.ts

@@ -11,6 +11,18 @@ export const duration = (secondsArg: number): string => secondsArg % 86400 === 0
 /** The same for a chosen duration that need not be whole minutes: `90s` reads `1m 30s`, never `1.5m`. */
 export const durationText = (secondsArg: number): string => secondsArg % 60 === 0 ? duration(secondsArg)
   : secondsArg < 60 ? `${secondsArg}s` : `${Math.floor(secondsArg / 60)}m ${secondsArg % 60}s`;
+/** The window lengths that have a name of their own; every other length is named by its compact duration. */
+const WINDOW_PERIODS: ReadonlyMap<number, string> = new Map([[18000, 'five-hour'], [86400, 'daily'], [604800, 'weekly'], [2592000, 'monthly'], [31536000, 'annual']]);
+/**
+ * How every adapter names a usage window in a label: by the window's length alone, so `Codex weekly` and
+ * `Claude weekly` mean the same thing and no label repeats a provider's internal slot name. These are the
+ * lengths Codex names in 0.155.0 too (`five-hour`, `daily`, `weekly`, `monthly`, `annual`), and a slot a
+ * window arrives in says nothing about how long it is. A length with no name of its own keeps its compact
+ * form (`90m`), which is honest about a window this vocabulary does not know rather than rounding it.
+ *
+ * The narrow table cells stay on the compact form throughout (`5h 37% · 2h 13m`); a column is not a label.
+ */
+export const usageWindowPeriod = (secondsArg: number): string => WINDOW_PERIODS.get(secondsArg) ?? duration(secondsArg);
 /** A countdown is a snapshot of the provider's deadline, not proof a quota has reset. */
 export const until = (timestampArg: string | null, nowArg: number): string => {
   if (timestampArg === null) return 'Not scheduled';

package/ts/classes.claudecodeharness.ts

@@ -1,13 +1,13 @@
 import * as plugins from './plugins.js';
 import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
-import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw } from './classes.credentialstore.js';
+import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw, type IStoredCredential } from './classes.credentialstore.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
 import { ClaudeAccountStatus } from './classes.claudestatus.js';
 import { ClaudeCodeLocks } from './classes.claudecodelocks.js';
 import { ClaudeTokenRefresh, type IClaudeTokens } from './classes.claudetokenrefresh.js';
 import { CLAUDE_LOGIN_REJECTED, ClaudeLoginRejectedError, ClaudeRateLimitError } from './claudehttp.js';
 import { writeSecretFileAtomically } from './helpers.js';
-import type { IHarnessAccountStatus, IHarnessProcessControl, IHarnessStatusOptions } from './interfaces.harness.js';
+import type { IHarnessAccountStatus, IHarnessProcessControl, IHarnessState, IHarnessStatusOptions } from './interfaces.harness.js';
 
 export interface IClaudeCodeHarnessOptions {
   configDir?: string;
@@ -26,6 +26,25 @@ export interface IClaudeCodeHarnessOptions {
   now?: () => number;
 }
 
+/**
+ * How long a read waits for the store and for Claude Code's locks before leaving the saved copy as it found it.
+ *
+ * Reading accounts must stay as quick as it is while a switch, a refresh or a Claude Code session holds a lock. The
+ * saved copy has nothing to finish: whatever the operation holding the lock writes is what the next read mirrors.
+ */
+const MIRROR_WAIT_MS = 1_000;
+
+/**
+ * A saved login the sign-in service refuses, in terms the user can act on.
+ *
+ * Claude Code rotates the refresh token of the login it is running on (hints.md), and a saved copy keeps the token
+ * it was stashed with. Once such a login has been replaced outside authswitch -- a `claude /login`, a new device
+ * login -- nothing writes the rotation back, and the service was observed refusing the older token the saved copy
+ * still holds (2026-09-18, two saved logins). No retry, no other account and no switch changes that answer; logging
+ * in again and saving that login does, so the message says so.
+ */
+const SAVED_LOGIN_REJECTED = `${CLAUDE_LOGIN_REJECTED} Claude Code rotates a login's refresh token as it uses it, and the service can refuse the older one a saved copy still holds once that login has been replaced outside authswitch; authswitch claude stash --keep saves the new one.`;
+
 const accountCaches = ['additionalModelOptionsCache', 'additionalModelOptionsAnsweredAt', 'additionalModelCostsCache', 'modelAccessCache', 'orgModelDefaultCache', 'lastSeenOrgDefaultUpdatedAt', 'clientDataCache', 'clientDataCacheSlots', 'autoCompactWindowsCache', 'cachedUsageUtilization'];
 
 /**
@@ -36,7 +55,8 @@ const accountCaches = ['additionalModelOptionsCache', 'additionalModelOptionsAns
  * and write therefore runs under Claude Code's own locks instead of asking for it to be stopped.
  *
  * Nothing else refreshes a saved login, so its access token expires a few hours after it was saved. Reading such a
- * login's status refreshes it first, the way Claude Code would; the active login's tokens belong to Claude Code.
+ * login's status refreshes it first, the way Claude Code would; the active login's tokens belong to Claude Code, and
+ * reading the accounts mirrors that login into its own saved copy, so the stash keeps what Claude Code last wrote.
  */
 export class ClaudeCodeHarness extends FileHarness {
   public readonly id = 'claude';
@@ -55,14 +75,6 @@ export class ClaudeCodeHarness extends FileHarness {
   private readonly settingsFiles: string[];
   private readonly locks: ClaudeCodeLocks;
   private readonly tokens: ClaudeTokenRefresh;
-  /**
-   * The refresh token the service rejected, per account: a hash, never the token itself.
-   *
-   * A rejected grant stays rejected until a new Claude Code login replaces the saved record, so replaying it would
-   * only add traffic to an auth endpoint -- once every tick of a watch, for as long as it runs. The entry is
-   * superseded as soon as the record holds a different refresh token.
-   */
-  private readonly rejectedGrants = new Map<string, string>();
 
   constructor(options: IClaudeCodeHarnessOptions = {}) {
     super();
@@ -151,6 +163,52 @@ export class ClaudeCodeHarness extends FileHarness {
   /** The hash that identifies a saved login's refresh token, so a rejected grant is remembered without keeping it. */
   private grantKey(oauthArg: Record<string, unknown>): string { return credentialHash(credentialText(oauthArg.refreshToken) ?? ''); }
 
+  /**
+   * The harness's accounts, with the saved copy of the active login brought up to date first.
+   *
+   * Claude Code rotates the refresh token of the login it is running on, and until now only a switch or a save wrote
+   * that back into the stash. A login replaced outside authswitch between two switches therefore left a saved copy
+   * holding the token from before the rotation, which the service was observed refusing -- a saved copy that only
+   * turns out to be unusable when that account's status is next read. Every read of the native login now mirrors it
+   * into its own saved record, so the stash keeps the credential Claude Code last wrote for an account that has one.
+   */
+  public async readState(): Promise<IHarnessState> {
+    await this.mirrorActiveLogin();
+    return super.readState();
+  }
+
+  /**
+   * Writes the active login into its own saved record when the two differ.
+   *
+   * This is the only write a read makes, and it is advisory: a store another operation holds, a lock Claude Code
+   * holds and files that keep changing under it all leave the saved copy as it is, because the next read mirrors
+   * whatever they wrote. The native files are only ever read, and a login without a saved record of its own is
+   * never saved implicitly -- that is what `stash` is for.
+   */
+  private async mirrorActiveLogin(): Promise<void> {
+    try {
+      if (this.staleSavedCopy(this.snapshot()) === null) return;
+      await this.store.locked(() => this.locks.hold(() => {
+        // Under both locks the decision is taken again, from a snapshot proven not to have been read across a write.
+        const stale = this.staleSavedCopy(this.stableSnapshot());
+        if (stale !== null) this.store.replaceCredential(stale.id, stale.credential);
+        return [];
+      }, { timeoutMs: MIRROR_WAIT_MS }), { signal: AbortSignal.timeout(MIRROR_WAIT_MS) });
+    } catch { /* A saved copy that could not be brought up to date is no reason to fail a read of the accounts. */ }
+  }
+
+  /** The active login's saved record when it no longer holds what Claude Code wrote, with the credential to write. */
+  private staleSavedCopy(snapshotArg: IFileHarnessSnapshot): { id: string; credential: Record<string, unknown> } | null {
+    // Claude Code runs one login, and an installation this adapter cannot read reports none at all.
+    const [active] = snapshotArg.accounts;
+    if (!active) return null;
+    const id = this.store.id(active.slotId, active.identity);
+    let saved: IStoredCredential;
+    try { saved = this.store.read(id); } catch { return null; }
+    return credentialHash(JSON.stringify(saved.credential)) === credentialHash(JSON.stringify(active.credential))
+      ? null : { id, credential: active.credential };
+  }
+
   /**
    * What the native files say about this account: its active login, and why they could not be read at all.
    *
@@ -182,12 +240,14 @@ export class ClaudeCodeHarness extends FileHarness {
     if (view.unavailable !== null) {
       return this.status.unavailable(oauth, `Login refresh: this saved login's access token has expired and cannot be renewed for this installation. ${view.unavailable}`);
     }
-    if (this.rejectedGrants.get(id) === this.grantKey(oauth)) return this.status.unavailable(oauth, `Login refresh: ${CLAUDE_LOGIN_REJECTED}`);
+    if (this.store.read(id).rejectedGrant === this.grantKey(oauth)) return this.status.unavailable(oauth, `Login refresh: ${SAVED_LOGIN_REJECTED}`);
     let refreshed: IFileAccount;
     try { refreshed = await this.refreshSaved(id, optionsArg.signal); }
     catch (error) {
       if (optionsArg.signal?.aborted) throw error;
-      return this.status.unavailable(oauth, `Login refresh: ${error instanceof Error ? error.message : 'the saved login could not be refreshed.'}`,
+      const problem = error instanceof ClaudeLoginRejectedError ? SAVED_LOGIN_REJECTED
+        : error instanceof Error ? error.message : 'the saved login could not be refreshed.';
+      return this.status.unavailable(oauth, `Login refresh: ${problem}`,
         error instanceof ClaudeRateLimitError ? { retryAt: error.retryAt } : undefined);
     }
     return read(refreshed);
@@ -214,7 +274,7 @@ export class ClaudeCodeHarness extends FileHarness {
       try { tokens = await this.tokens.refresh(oauth); }
       catch (error) {
         // Only this token was rejected; a login saved again replaces it and is tried like any other.
-        if (error instanceof ClaudeLoginRejectedError) this.rejectedGrants.set(id, this.grantKey(oauth));
+        if (error instanceof ClaudeLoginRejectedError) this.recordRejectedGrant(id, oauth);
         throw error;
       }
       const latest = this.savedCredential(id);
@@ -224,4 +284,17 @@ export class ClaudeCodeHarness extends FileHarness {
       return this.savedCredential(id);
     }, { signal });
   }
+
+  /**
+   * Remembers a rejected grant in the saved record, so the next process does not send it again either -- a watch
+   * would otherwise replay a dead login every tick, and every new CLI run once more. It is written only while the
+   * record still holds the token that was sent, and a record that could not be written changes nothing but that:
+   * the refusal the caller reports is the answer, and the grant is simply tried once more.
+   */
+  private recordRejectedGrant(id: string, oauthArg: Record<string, unknown>): void {
+    try {
+      const latest = credentialRecord(this.savedCredential(id).credential.claudeAiOauth);
+      if (latest.refreshToken === oauthArg.refreshToken) this.store.rememberRejectedGrant(id, this.grantKey(oauthArg));
+    } catch { /* Recording is advisory; the rejection is reported either way. */ }
+  }
 }

package/ts/classes.claudecodelocks.ts

@@ -65,11 +65,12 @@ export class ClaudeCodeLocks {
    * A held lock never makes authswitch sit on the others: like Claude Code, it releases what it holds, waits and
    * starts again, so a live session is never blocked by a switch that is still waiting. A lock that could not be
    * released afterwards is reported as an outcome line, because the write it guarded has completed and the lock
-   * expires on its own.
+   * expires on its own. `timeoutMs` shortens the wait for a caller that must not make a user wait for it -- a read
+   * bringing a saved copy up to date has nothing to finish and can leave it to the next read.
    */
-  public async hold(actionArg: () => string[]): Promise<string[]> {
+  public async hold(actionArg: () => string[], optionsArg: { timeoutMs?: number } = {}): Promise<string[]> {
     const lockfile = await plugins.loadProperLockfile();
-    const deadline = Date.now() + this.timeoutMs;
+    const deadline = Date.now() + (optionsArg.timeoutMs ?? this.timeoutMs);
     const held: IHeldLock[] = [];
     const unreleased: string[] = [];
     const releaseAll = async (): Promise<void> => {

package/ts/classes.claudestatus.ts

@@ -2,6 +2,7 @@ import { credentialHash, credentialRecord, credentialText } from './classes.cred
 import { claudeRequest, ClaudeLoginRejectedError, ClaudeRateLimitError, ClaudeRequestError } from './claudehttp.js';
 import { latestRetryAt } from './ratelimit.js';
 import { plainText } from './formatting.js';
+import { usageWindowPeriod } from './accounts.js';
 import type { IHarnessAccountStatus, IHarnessStatusFact, IHarnessStatusOptions, IHarnessUsageWindow, TUsageSeverity } from './interfaces.harness.js';
 
 interface IClaudeUsageWindows {
@@ -22,31 +23,31 @@ const serverName = (value: unknown): string => {
   return name;
 };
 
-/** Keyed windows, read only from a usage body that carries no limits[] rows. */
+/** Keyed windows, read only from a usage body that carries no limits[] rows: what each meter is about, and how long its window is. */
 const KEYED_WINDOWS = [
-  ['five_hour', 'Claude five-hour', 18000, 'account'], ['seven_day', 'Claude weekly', 604800, 'account'],
-  ['seven_day_oauth_apps', 'OAuth apps weekly', 604800, 'feature'], ['seven_day_opus', 'Opus weekly', 604800, 'feature'], ['seven_day_sonnet', 'Sonnet weekly', 604800, 'feature'],
+  ['five_hour', 'Claude', 18000, 'account'], ['seven_day', 'Claude', 604800, 'account'],
+  ['seven_day_oauth_apps', 'OAuth apps', 604800, 'feature'], ['seven_day_opus', 'Opus', 604800, 'feature'], ['seven_day_sonnet', 'Sonnet', 604800, 'feature'],
 ] as const;
 
 const keyedWindows = (usage: Record<string, unknown>): IHarnessUsageWindow[] => {
   const windows: IHarnessUsageWindow[] = [];
-  for (const [key, label, durationSeconds, scope] of KEYED_WINDOWS) {
+  for (const [key, subject, durationSeconds, scope] of KEYED_WINDOWS) {
     if (usage[key] == null) continue;
     const window = credentialRecord(usage[key]);
     if (window.utilization == null) continue;
     if (typeof window.utilization !== 'number' || !Number.isFinite(window.utilization) || window.utilization < 0) throw new Error('Unsupported Claude usage utilization.');
-    windows.push({ label, durationSeconds, scope, usedPercent: window.utilization, resetAt: resetTimestamp(window.resets_at) });
+    windows.push({ label: `${subject} ${usageWindowPeriod(durationSeconds)}`, durationSeconds, scope, usedPercent: window.utilization, resetAt: resetTimestamp(window.resets_at) });
   }
   return windows;
 };
 
 /**
- * The limits[] row groups the window model represents: each group's duration, the period word its
- * labels use, and the kind of the group's unscoped account meter, which keeps the plain label.
+ * The limits[] row groups the window model represents: each group's duration, which names its windows,
+ * and the kind of the group's unscoped account meter, which keeps the plain label.
  */
-const LIMIT_GROUPS: ReadonlyMap<string, { durationSeconds: number; period: string; accountKind: string }> = new Map([
-  ['session', { durationSeconds: 18000, period: 'five-hour', accountKind: 'session' }],
-  ['weekly', { durationSeconds: 604800, period: 'weekly', accountKind: 'weekly_all' }],
+const LIMIT_GROUPS: ReadonlyMap<string, { durationSeconds: number; accountKind: string }> = new Map([
+  ['session', { durationSeconds: 18000, accountKind: 'session' }],
+  ['weekly', { durationSeconds: 604800, accountKind: 'weekly_all' }],
 ]);
 
 const isUsageSeverity = (value: unknown): value is TUsageSeverity => value === 'normal' || value === 'warning' || value === 'critical';
@@ -82,8 +83,9 @@ const limitWindows = (rows: readonly unknown[]): IClaudeUsageWindows => {
       continue;
     }
     const severity = row.severity;
+    const period = usageWindowPeriod(meter.durationSeconds);
     windows.push({
-      label: subject === undefined ? `Claude ${meter.period}${kind === meter.accountKind ? '' : ` (${kindName})`}` : `${subject} ${meter.period}`,
+      label: subject === undefined ? `Claude ${period}${kind === meter.accountKind ? '' : ` (${kindName})`}` : `${subject} ${period}`,
       durationSeconds: meter.durationSeconds, scope: subject === undefined ? 'account' : 'feature', usedPercent, resetAt,
       ...(isUsageSeverity(severity) ? { severity } : {}),
       ...(row.is_active === true ? { headline: true as const } : {}),

package/ts/classes.cli.ts

@@ -4,12 +4,12 @@ import { CodexHarness } from './classes.codexharness.js';
 import { OpenCodeHarness } from './classes.opencodeharness.js';
 import { ClaudeCodeHarness } from './classes.claudecodeharness.js';
 import { AuthSwitchTui } from './classes.tui.js';
-import { AglAuthSwitchCoordinator, AuthSwitchOperations, type TAuthSwitchCoordinator, type TAuthSwitchMutation } from './classes.operations.js';
+import { AglAuthSwitchCoordinator, AuthSwitchOperations, authSwitchMutationReplacesLogin, type TAuthSwitchCoordinator, type TAuthSwitchMutation } from './classes.operations.js';
 import { readAccountList } from './classes.accountlist.js';
 import { AccountListRenderer } from './classes.listrenderer.js';
 import { accountLimits, activeAccounts, CondensedRenderer } from './classes.limits.js';
 import { consoleTable } from './consoletable.js';
-import { accountName, credentialDriftNote, duration, orderedUsageWindows, readAccountBadges, until, usagePercentText } from './accounts.js';
+import { accountName, credentialDriftNote, orderedUsageWindows, readAccountBadges, until, usagePercentText } from './accounts.js';
 import { describeHarnessProcesses, describeStopOutcome } from './classes.harnessprocesses.js';
 import { defaultPreusePrompt, PreuseError, validatePreuseOptions } from './preuse.js';
 import { parseCommandArgs, parseDurationOption, parseIntegerOption, UsageError } from './cliargs.js';
@@ -247,10 +247,9 @@ ${bold('Environment')}
   }
 
   private mutate(harness: IAuthHarness, mutation: TAuthSwitchMutation, stopModeArg?: TStopMode): Promise<IHarnessOutcome> {
-    const replacesNativeLogin = mutation.action === 'switch' || (mutation.action === 'save' && !mutation.keepActive);
     return this.operations.run(harness, mutation, canPrompt() ? async message => await this.out.prompts.ask({
       name: 'waitForIdle', type: 'confirm', message, default: false,
-    }) === true : undefined, replacesNativeLogin ? () => this.settleRunningInstances(harness, stopModeArg) : undefined);
+    }) === true : undefined, authSwitchMutationReplacesLogin(mutation) ? () => this.settleRunningInstances(harness, stopModeArg) : undefined);
   }
 
   /**
@@ -383,7 +382,8 @@ ${bold('Environment')}
           const now = Date.now();
           process.stdout.write('Reset schedule reported after the prompt:\n');
           await consoleTable(this.out, windows, [
-            { key: 'window', title: 'Window', value: row => `${plainText(row.label)} (${duration(row.durationSeconds)})` },
+            // The label already names the window by its length, so the column never repeats it.
+            { key: 'window', title: 'Window', value: row => plainText(row.label) },
             { key: 'usage', title: 'Used', value: row => usagePercentText(row.usedPercent) },
             { key: 'reset', title: 'Reset in', value: row => until(row.resetAt, now) },
           ]);

package/ts/classes.codexstatus.ts

@@ -1,6 +1,7 @@
 import type { ICodexIdentity } from './interfaces.js';
 import type { IHarnessAccountStatus, IHarnessStatusOptions, IHarnessStatusSummary } from './interfaces.harness.js';
 import { commitinfo } from './00_commitinfo_data.js';
+import { usageWindowPeriod } from './accounts.js';
 import { latestRetryAt, retryAtFrom } from './ratelimit.js';
 
 // Verified Chromium-compatible billing request profile, independent of any locally installed browser.
@@ -38,9 +39,13 @@ class StatusRateLimitError extends StatusRequestError {
 }
 
 /**
- * Read-only ChatGPT status contract verified against Codex 0.154.0.
+ * Read-only ChatGPT status contract verified against Codex 0.155.0.
  * These source-defined backend routes are isolated here. No token refresh,
  * credential writes, app-server lifecycle changes or reset consumption occur.
+ *
+ * The service decides how many usage windows an account has: it sends the ones it keeps for that
+ * account, leaving the other slot `null`, so a login whose general quota is a single weekly window is
+ * reported with that one window and no five-hour limit is invented to fill the gap.
  */
 export class CodexAccountStatus {
   constructor(private readonly fetcher: typeof fetch = globalThis.fetch, private readonly now: () => number = Date.now) {}
@@ -184,16 +189,23 @@ export class CodexAccountStatus {
       // The service's own reading of the same windows, so a view that shows the windows need not repeat it.
       facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} usage allowed`, value: boolean(limit.allowed) ? 'yes' : 'no' });
       facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} limit reached`, value: boolean(limit.limit_reached) ? 'yes' : 'no' });
-      for (const [key, name] of [['primary_window', 'primary'], ['secondary_window', 'secondary']]) {
-        if (limit[key] == null) continue;
-        const window = record(limit[key]);
-        const used = numeric(window.used_percent);
-        const durationSeconds = numeric(window.limit_window_seconds);
-        const minutes = durationSeconds / 60;
-        const duration = minutes % 1440 === 0 ? `${minutes / 1440}d` : minutes % 60 === 0 ? `${minutes / 60}h` : `${minutes}m`;
-        const resetAt = timestamp(window.reset_at);
-        usageWindows.push({ label: `${nameArg} ${name}`, scope: scopeArg, durationSeconds, usedPercent: used, resetAt });
-        facts.push({ section: 'Usage', summaryKey: 'usageWindows', label: `${nameArg} ${name} (${duration})`, value: `${used}% used, ${Math.max(0, 100 - used)}% remaining; resets ${resetAt}` });
+      // Both slots are read before either is named: only a second window of the same length makes the
+      // vendor's slot worth showing, and that is decided from the pair.
+      const windows = (['primary_window', 'secondary_window'] as const).flatMap((slotArg) => {
+        if (limit[slotArg] == null) return [];
+        const window = record(limit[slotArg]);
+        return [{
+          slot: slotArg === 'primary_window' ? 'primary' : 'secondary',
+          usedPercent: numeric(window.used_percent), durationSeconds: numeric(window.limit_window_seconds), resetAt: timestamp(window.reset_at),
+        }];
+      });
+      for (const window of windows) {
+        // Named by its length, as Codex names its own windows: a slot carries no length, and which
+        // window the service puts in it varies by plan and by which limit is currently binding.
+        const shared = windows.some(other => other !== window && other.durationSeconds === window.durationSeconds);
+        const label = `${nameArg} ${usageWindowPeriod(window.durationSeconds)}${shared ? ` (${window.slot})` : ''}`;
+        usageWindows.push({ label, scope: scopeArg, durationSeconds: window.durationSeconds, usedPercent: window.usedPercent, resetAt: window.resetAt });
+        facts.push({ section: 'Usage', summaryKey: 'usageWindows', label, value: `${window.usedPercent}% used, ${Math.max(0, 100 - window.usedPercent)}% remaining; resets ${window.resetAt}` });
       }
     };
     appendLimit('Codex', bodyArg.rate_limit, 'account');

package/ts/classes.credentialstore.ts

@@ -62,6 +62,14 @@ export interface IStoredCredential {
   savedAt: string;
   /** Harness-owned payload. This object must never cross the public account interface. */
   credential: Record<string, unknown>;
+  /**
+   * A refresh token of this credential that the provider refused, as a hash -- never the token.
+   *
+   * A grant the provider rejected stays rejected, so replaying it only adds traffic to an auth endpoint, once per
+   * status read for as long as the record holds that token. Remembering it in the record instead of in memory is
+   * what makes that true for the next process too. Every write that replaces the credential drops it.
+   */
+  rejectedGrant?: string;
 }
 
 /** The root of authswitch's own state: `AUTHSWITCH_HOME`, or `~/.authswitch`. */
@@ -89,8 +97,10 @@ export class CredentialStore {
     this.lockTimeoutMs = optionsArg.lockTimeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
   }
   public id(slot: string, identity: string): string { return credentialHash(JSON.stringify([slot, identity])); }
+  /** Whether a value names a credential hash: a rejected grant, or an account id. */
+  private isHash(value: unknown): boolean { return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value); }
   private file(id: string): string {
-    if (!/^[a-f0-9]{64}$/.test(id)) throw new Error('Invalid saved account ID.');
+    if (!this.isHash(id)) throw new Error('Invalid saved account ID.');
     return plugins.path.join(this.dir, `${id}.json`);
   }
   public read(id: string): IStoredCredential {
@@ -99,6 +109,9 @@ export class CredentialStore {
       || !credentialText(value.label) || typeof value.savedAt !== 'string' || !Number.isFinite(Date.parse(value.savedAt))
       || this.id(value.slotId as string, value.identity as string) !== id) throw new Error('Saved account metadata is invalid; restore it from a verified backup.');
     credentialRecord(value.credential);
+    // Advisory state: a rejected grant that is not a hash says nothing about the login and is dropped, never made
+    // the record's problem -- the grant is sent once more instead, which is what a record without one means anyway.
+    if (!this.isHash(value.rejectedGrant)) delete value.rejectedGrant;
     return value as unknown as IStoredCredential;
   }
   public list(): IStoredCredential[] {
@@ -115,7 +128,18 @@ export class CredentialStore {
    * it was saved stay as they are. The caller holds the lock and has checked the record it replaces.
    */
   public replaceCredential(id: string, credential: Record<string, unknown>): IStoredCredential {
-    return this.write({ ...this.read(id), credential }, 'The refreshed login could not be verified after saving it.');
+    const record = this.read(id);
+    // A remembered rejection belongs to the credential it was taken from; the new one has not been refused.
+    delete record.rejectedGrant;
+    return this.write({ ...record, credential }, 'The refreshed login could not be verified after saving it.');
+  }
+  /**
+   * Remembers that the provider refused the refresh token this record holds, as `grantHashArg`. The caller holds the
+   * lock and has checked that the record still holds the token it sent.
+   */
+  public rememberRejectedGrant(id: string, grantHashArg: string): IStoredCredential {
+    if (!this.isHash(grantHashArg)) throw new Error('A rejected grant is remembered as a credential hash.');
+    return this.write({ ...this.read(id), rejectedGrant: grantHashArg }, 'The refused sign-in could not be recorded.');
   }
   private write(record: IStoredCredential, failureArg: string): IStoredCredential {
     plugins.fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });

package/ts/classes.fileharness.ts

@@ -1,4 +1,4 @@
-import type { IAuthHarness, IHarnessAccountStatus, IHarnessCredentialDrift, IHarnessOutcome, IHarnessProcessControl, IHarnessState, IHarnessStatusOptions } from './interfaces.harness.js';
+import type { IAuthHarness, IHarnessAccountStatus, IHarnessCredentialDrift, IHarnessOutcome, IHarnessProcessControl, IHarnessState, IHarnessStatusOptions, THarnessResult } from './interfaces.harness.js';
 import { credentialHash, CredentialStore, type IStoredCredential, type ISwitchRecord } from './classes.credentialstore.js';
 import { pauseSynchronously } from './helpers.js';
 import { plainText } from './formatting.js';
@@ -52,7 +52,7 @@ export abstract class FileHarness implements IAuthHarness {
    * credential out of the stash. Both the retry count and the pause between attempts are bounded; an
    * unstable file is reported, never guessed at.
    */
-  private stableSnapshot(): IFileHarnessSnapshot {
+  protected stableSnapshot(): IFileHarnessSnapshot {
     let failure: unknown;
     for (let attempt = 0; attempt < 5; attempt++) {
       if (attempt) pauseSynchronously(20);
@@ -72,7 +72,11 @@ export abstract class FileHarness implements IAuthHarness {
     if (account.identity !== entry.identity) throw new Error('Saved credential does not match its account identity.');
     return account;
   }
-  public readState(): IHarnessState {
+  /**
+   * The harness's accounts. A subclass may have to bring its own state up to date first -- the Claude Code adapter
+   * mirrors the active login into its saved copy -- which is why this is the interface's `THarnessResult`.
+   */
+  public readState(): THarnessResult<IHarnessState> {
     const snapshot = this.snapshot();
     const saved = this.store.list();
     const accounts: IHarnessState['accounts'] = saved.map(entry => {
@@ -243,9 +247,9 @@ export abstract class FileHarness implements IAuthHarness {
   public removeAccount(id: string): Promise<IHarnessOutcome> {
     return this.outcome(() => { const account = this.store.read(id); this.store.remove(id); return `Removed saved login for ${plainText(account.label)}; the active login is preserved.`; }, false);
   }
-  public diagnose(): IHarnessOutcome {
+  public async diagnose(): Promise<IHarnessOutcome> {
     try {
-      const state = this.readState();
+      const state = await this.readState();
       return { lines: [`${this.label}: ${state.accounts.filter(account => account.isActive).length} active login(s), ${state.accounts.filter(account => account.isStashed).length} saved account(s).`, this.loginHint], problems: state.saveUnavailableReason ? [state.saveUnavailableReason] : [] };
     } catch { return { lines: [], problems: ['Credential storage could not be verified. Check file permissions and saved credential records.'] }; }
   }