@rikcodes/teamclaude 1.1.20-rik.1 → 1.1.20-rik.10

package/README.md

@@ -1,7 +1,7 @@
 # TeamClaude
 
 > **Fork notice (rikbrown).** This fork adds two features on top of
-> [KarpelesLab/teamclaude](https://github.com/KarpelesLab/teamclaude), currently based on upstream 1.1.19:
+> [KarpelesLab/teamclaude](https://github.com/KarpelesLab/teamclaude), currently based on upstream 1.1.20:
 >
 > - **[OpenAI models via a Codex sidecar](docs/openai.md)** (`sidecars` + `customModels`, opt-in):
 >   route `gpt-*` requests through a supervised local translating proxy to a ChatGPT subscription,
@@ -150,7 +150,7 @@ At launch, `teamclaude run` — and the `claude` alias, which passes through `ru
 | Row field | Where it ends up |
 | --- | --- |
 | `model`, `label`, `description` | A `/model` picker row under the **real** model id (`--settings`), so `/model gpt-5.6-sol` works picked or typed |
-| `model` | A dispatchable subagent named after the model (`--agents`), so "dispatch a `gpt-5.6-terra` subagent" works from a Claude parent |
+| `model` | A dispatchable subagent named after the model (`--agents`), so "dispatch a `gpt-5.6-terra` subagent" works from a Claude parent. Set `"customModelAgents": false` to skip these if you define your own agents in `~/.claude/agents/` |
 | `contextTokens` | `CLAUDE_CODE_MAX_CONTEXT_TOKENS`, set to the largest value across rows, so Claude Code compacts at the real window instead of assuming 200k |
 
 For tools that spawn `claude` themselves, `teamclaude env` can set only environment variables. It carries the window and `ANTHROPIC_CUSTOM_MODEL_OPTION` for the **first** row. For GPT subagents under `env`, create `~/.claude/agents/<name>.md` with `model: gpt-5.6-terra` in its frontmatter.
@@ -163,9 +163,67 @@ Each request is routed by the model name in its body, so one session can freely
 2. Add a `customModels` row. Codex publishes the window for each model as `context_window` in `~/.codex/models_cache.json`; copy it to `contextTokens`.
 3. Start a new `teamclaude run` session. The rows are read at launch, so you do not need to restart the server. If you upgraded the sidecar binary, restart the server — or send `SIGTERM` to the sidecar process and let the supervisor restart it with the new binary.
 
-Claude Code prints one `[claude-code:unrecognized_model]` line to stderr for each custom model. This is expected; suppressing it would lose the correct context window. The quota bars for the sidecar account show `unknown` unless the sidecar forwards Codex's rate-limit headers — see [Quota](docs/openai.md#quota). Keep the sidecar on loopback, and use **one** ChatGPT subscription for each person. Pooling several subscriptions is the pattern that OpenAI's fraud systems target ([terms of service](docs/openai.md#terms-of-service)).
+Claude Code prints one `[claude-code:unrecognized_model]` line to stderr for each custom model. This is expected; suppressing it would lose the correct context window. The quota bars for the sidecar account show `unknown` unless the sidecar forwards Codex's rate-limit headers — see [Quota](docs/openai.md#quota). Keep the sidecar on loopback.
 
-Full details: [docs/openai.md](docs/openai.md).
+The sidecar appears under the account table as a `⚙` line rather than a row because it holds no subscription, is the only account its route can use, and never rotates. The line also shows its supervised process state (`up pid 98018`, or `down (code 1) 3 restarts`).
+
+#### Several ChatGPT accounts
+
+> **Read the [terms of service](docs/openai.md#terms-of-service) before setting this up.** OpenAI's Terms of Use prohibit rotating ChatGPT subscriptions past a spent window, and account suspension is a plausible consequence. This is a sharper trade-off than pooling Claude subscriptions because the first-party client lets you switch Claude subscriptions by hand.
+
+One sidecar holds one ChatGPT login, so GPT requests do not rotate and its quota belongs to a login that TeamClaude does not own. Point the sidecar's **back leg** at TeamClaude so native Codex accounts serve it instead:
+
+```
+Claude Code ──▶ TC /v1/messages (gpt-*) ──▶ sidecar account ──▶ sidecar translates
+            ──▶ TC /backend-api/codex/responses ──▶ ChatGPT account pool ──▶ chatgpt.com
+```
+
+Each hop is classified by its path, and the subscription partition keeps the pools apart: on the way in only the sidecar account is eligible, on the way back only the ChatGPT accounts. One route lists both.
+
+**1. Add the accounts** — run `teamclaude login --codex` once for each one. A Codex login takes its email as its name. Your Anthropic account probably uses the same name, so the Codex name gets a prefix to keep it unambiguous:
+
+```
+$ teamclaude login --codex
+Named "codex:you@example.com" — "you@example.com" is already an account on another provider.
+```
+
+**2. Redirect the sidecar** and stub its own login, so TeamClaude supplies the credential instead:
+
+```json
+{ "name": "codex",
+  "command": ["claude-code-proxy", "serve", "--no-monitor", "--port", "18765"],
+  "env": {
+    "CCP_CODEX_BASE_URL": "http://127.0.0.1:3456/backend-api/codex/responses",
+    "CCP_CODEX_TRANSPORT": "http"
+  } }
+```
+
+```bash
+cd ~/.config/claude-code-proxy/codex
+cp auth.json auth.json.bak                      # the real login — keep it
+echo '{ "access": "delegated-to-teamclaude", "refresh": "", "expires": 4102444800000 }' > auth.json
+```
+
+The sidecar refuses to start with an empty store but never refreshes a far-future token, and TeamClaude replaces both the bearer and the account header on the way out. Leave `accountId` unset so none of the sidecar's own identity can leak.
+
+**3. Put them all on the `gpt-*` route**, sidecar included, and give each account a `headersTimeoutMs` — the 120s fleet default is shorter than a long reasoning turn:
+
+```json
+{ "name": "codex", "match": ["gpt-*"],
+  "accounts": ["codex", "codex:you@example.com", "codex:you@work.example"] }
+```
+
+**4. Restart the server.** A `sidecars[].env` change is read once at startup, so a reload is not enough.
+
+Three details matter:
+
+- **Leave the sidecar account on the route.** It can look removable because it is not a subscription or an account row, but it is the routing target for the way *in*. Without it, every `gpt-*` request fails to find an account while `teamclaude status` shows two healthy ChatGPT accounts on the route.
+- **`CCP_CODEX_TRANSPORT=http` is required.** A WebSocket upgrade is relayed with the caller's own headers and draws no account, so the WebSocket transport cannot be pooled.
+- **Do not reuse a name across providers.** Routes address accounts by name, so a shared name admits both — including the Claude account that cannot serve `gpt-*`, which outranks the sidecar on priority and wins. TeamClaude warns at startup when it sees one.
+
+Two things differ from the single-account setup: each turn appears **twice** in the activity list, once per hop, and tokens are booked against the sidecar account, so a ChatGPT account reads `N req · 0 tok`. Its quota bars are unaffected because they come from the `x-codex-*` headers on the second hop, where the subscription is.
+
+Full details, including what happens to quota on each hop: [Several ChatGPT accounts behind one sidecar](docs/openai.md#several-chatgpt-accounts-behind-one-sidecar).
 
 ### Burn-rate projection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.20-rik.1",
+  "version": "1.1.20-rik.10",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,5 +1,5 @@
 import { refreshAccessToken, isTokenExpiringSoon, isTokenExpired, formatMoney } from './oauth.js';
-import { providerOf, DEFAULT_PROVIDER, isSubscriptionAccount } from './provider.js';
+import { providerOf, DEFAULT_PROVIDER, isSubscriptionAccount, isLocalUpstream } from './provider.js';
 import { refreshCodexToken } from './codex-auth.js';
 import { parseCodexQuota, parseCodexPlanType } from './codex-quota.js';
 import { sameIdentity } from './identity.js';
@@ -221,6 +221,13 @@ function makeAccount(acct, index) {
     // Fields to drop from request bodies for this account (third-party upstreams
     // that reject e.g. `context_management`). See server.js stripBodyFields.
     stripRequestFields: acct.stripRequestFields || null,
+    // Whether this upstream keeps Anthropic message-thread state. Off for a
+    // third-party backend, which would otherwise be handed a bare delta. See
+    // server.js refusesThreadContinue.
+    messageThreads: acct.messageThreads === true,
+    // Whether the operator has already been told this upstream keeps no thread
+    // state, so the line is printed once rather than per refusal.
+    threadRefusalReported: false,
     // Per-account response-headers deadline (ms); null means the fleet default
     // in upstream-fetch.js. See normalizeHeadersTimeoutMs.
     headersTimeoutMs: normalizeHeadersTimeoutMs(acct.headersTimeoutMs),
@@ -355,6 +362,10 @@ export class AccountManager {
     // it. Each such switch arms the ramp below, so steady interleaved traffic
     // holds both accounts at the ramp floor while nothing has failed over.
     this.routeCursors = new Map();
+    /** Rotation for requests that carry no session id; separate from the shared
+     *  cursor so turning it never moves a running session's account.
+     *  @type {number} */
+    this._untaggedCursor = 0;
     // One cursor per provider. `currentIndex` is a single slot, and a request
     // only another provider can serve would otherwise drag it across: a Codex
     // request moved it onto a Codex account and the next Anthropic request moved
@@ -688,7 +699,7 @@ export class AccountManager {
     if (!account?.entitlementDeniedUntil) return false;
     if (now < account.entitlementDeniedUntil) return true;
     account.entitlementDeniedUntil = null;
-    console.log(`[TeamClaude] Account "${account.name}" entitlement cooldown expired, marking available`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" entitlement cooldown expired, marking available`);
     return false;
   }
 
@@ -851,6 +862,12 @@ export class AccountManager {
         if (acc) return acc;
       }
     }
+    // An untagged request has no session to pin, so the walk below rests every
+    // one of them on the current account. Spread them too, on their own cursor.
+    if (!sessionId && this.distributeSessions && !this._pinnedAccountForModel(model, advisorModel)) {
+      const acc = this._selectUntagged(exclude, model, advisorModel);
+      if (acc) return acc;
+    }
     if (advisorModel) {
       const account = this._select(exclude, model, advisorModel, false);
       if (account) return account;
@@ -944,6 +961,41 @@ export class AccountManager {
    * eligible account. Returns null if nothing is eligible, so the caller falls
    * back to the normal quota-driven walk. Does NOT record the pin — that happens
    * on the actual route (recordSession), so retries/failover re-pin naturally. */
+  /**
+   * Round-robin for requests that carry no session id.
+   *
+   * The Codex CLI tags `POST /responses` with `session-id` but not its catalog
+   * fetch, and Claude Code tags `/v1/messages` but not its telemetry. Those
+   * untagged requests have nothing to pin, so the walk below rests all of them
+   * on the current account: measured against a five-account Codex pool with
+   * distribution on, every session's `GET /models` landed on one account, 16
+   * requests against 1 apiece for its siblings.
+   *
+   * `_pickLeastLoaded` does not spread them. An untagged request never reaches
+   * `recordSession`, so it adds no session count, and a serial caller's
+   * in-flight is back to zero by the time the next one arrives — the tiebreak
+   * chain is level every time and answers with the same account. Hence a cursor
+   * of its own.
+   *
+   * That cursor is its own on purpose: `_setCurrent` is what sessions riding
+   * the shared one follow, and moving it from a catalog fetch would hand a
+   * running conversation to another account mid-flight and throw away the
+   * prompt cache it built there. An untagged request picks where it goes and
+   * changes nothing for anyone else.
+   *
+   * @param {Set<number>|null} exclude
+   * @param {string|null} model
+   * @param {string|null} advisorModel
+   * @returns {Record<string, any>|null}
+   */
+  _selectUntagged(exclude, model, advisorModel) {
+    const candidates = this._bandedCandidates(exclude, model, advisorModel);
+    if (candidates.length === 0) return null;
+    const cursor = this._untaggedCursor;
+    this._untaggedCursor = cursor + 1;
+    return candidates[cursor % candidates.length];
+  }
+
   _selectForSession(sessionId, exclude, model, advisorModel) {
     // The pin is per governing bucket, and this request is bound by the
     // EXECUTOR's: one request goes to one account, so the executor's affinity is
@@ -1680,7 +1732,7 @@ export class AccountManager {
       account.status = 'active';
       account.rateLimitedUntil = null;
       account.throttledAt = null;
-      console.log(`[TeamClaude] Account "${account.name}" rate limit expired, marking active`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" rate limit expired, marking active`);
     }
 
     if (account.status === 'exhausted') return 'exhausted';
@@ -2177,6 +2229,12 @@ export class AccountManager {
    * `_isAvailable` excludes accounts at or above the switch threshold. Shared by
    * both selection loops so they cannot disagree on the candidate set.
    */
+  /**
+   * @param {Set<number>|null} [exclude]
+   * @param {string|null} [model]
+   * @param {string|null} [advisorModel]
+   * @returns {Array<Record<string, any>>}
+   */
   _bandedCandidates(exclude = null, model = null, advisorModel = null) {
     return this._topPressureBand(
       this.accounts.filter(a => !exclude?.has(a.index) && this._isAvailable(a, model, advisorModel)),
@@ -2547,7 +2605,7 @@ export class AccountManager {
     const now = Date.now();
     if (now < (this._rolloverHeldLogAt.get(key) || 0)) return;
     this._rolloverHeldLogAt.set(key, now + 60_000);
-    console.log(`[TeamClaude] Account "${account.name}" rolled over its ${window} window ${this._heldRolloverReason(reason)}`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" rolled over its ${window} window ${this._heldRolloverReason(reason)}`);
   }
 
   /**
@@ -2699,14 +2757,27 @@ export class AccountManager {
   }
 
   /** Accounts a configured route can use (all accounts when it lists none), each
-   * with a live eligibility flag for a representative model of the route. */
+   * with a live eligibility flag for a representative model of the route and the
+   * provider that will serve it.
+   *
+   * A route that NAMES its accounts is shown in full, whatever provider each one
+   * belongs to. One route legitimately spans two: a translating sidecar reached
+   * on the Anthropic wire, plus the subscription pool its own back leg re-enters
+   * on the provider's path. Both hops are that route's traffic. Filtering the
+   * view by a single provider hid the second set completely — the route looked
+   * like it listed one account, and a newly added subscription that nobody had
+   * added to the list was invisible rather than merely idle, which is the exact
+   * shape of the diagnosis this view exists to prevent.
+   *
+   * A route that lists NOBODY is different: it constrains models, not accounts,
+   * so only the asking provider's own pool can serve it and the partition still
+   * applies. */
   _routeAccountsView(route, provider = DEFAULT_PROVIDER) {
     const sample = sampleModelFor(route);
-    const excluded = this._excludeOtherProviders(null, provider);
-    const inRoute = a => !route.accounts.length
-      || route.accounts.includes(a.name) || route.accounts.includes(String(a.index));
-    return this.accounts.filter(a => inRoute(a) && !excluded?.has(a.index))
-      .map(a => ({ name: a.name, eligible: this._isAvailable(a, sample) }));
+    const listed = route.accounts.length
+      ? this.accounts.filter(a => route.accounts.includes(a.name) || route.accounts.includes(String(a.index)))
+      : this.accounts.filter(a => !this._excludeOtherProviders(null, provider)?.has(a.index));
+    return listed.map(a => ({ name: a.name, provider: providerOf(a), eligible: this._isAvailable(a, sample) }));
   }
 
   /** A representative model id for a route name (configured or auto fable/sonnet),
@@ -2785,7 +2856,7 @@ export class AccountManager {
 
     // Clear expired unified quotas
     if (q.unified5h != null && q.unified5hReset && now >= q.unified5hReset) {
-      console.log(`[TeamClaude] Account "${account.name}" session quota reset`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" session quota reset`);
       // Recorded on the account, not just returned. _clearExpiredQuotas is
       // reached from two directions — refreshExpiredQuotas on the request path,
       // which runs the session-reset switch rule, and _isNearQuota via
@@ -2805,7 +2876,7 @@ export class AccountManager {
       session = true;
     }
     if (q.unified7d != null && q.unified7dReset && now >= q.unified7dReset) {
-      console.log(`[TeamClaude] Account "${account.name}" weekly quota reset`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" weekly quota reset`);
       q.unified7d = null;
       q.unified7dReset = null;
       q.unifiedStatus = null;
@@ -2849,7 +2920,7 @@ export class AccountManager {
       // so a reading is never discarded before it has had a window to prove out.
       if (!q[seenField]) { q[seenField] = now; continue; }
       if (now < q[seenField] + this.familyStaleMs) continue;
-      console.log(`[TeamClaude] Account "${account.name}" ${label} weekly reading is stale — revalidating on the next ${label} request`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" ${label} weekly reading is stale — revalidating on the next ${label} request`);
       q[key] = null;
       q[`${key}Reset`] = null;
       q[seenField] = null;
@@ -3284,7 +3355,7 @@ export class AccountManager {
     if (account.probing && account.quota.unified7dReset != null) {
       account.probing = false;
       account.requalify = true;
-      console.log(`[TeamClaude] Learned weekly quota for "${account.name}", re-evaluating selection`);
+      console.log(`[TeamClaude] Learned weekly quota for "${safeLine(account.name, 64)}", re-evaluating selection`);
     }
 
     this._observeBurnRate(account, observed);
@@ -3294,7 +3365,7 @@ export class AccountManager {
 
     if (this._isNearQuota(account)) {
       const pct = account.quota.unified7d != null ? Math.round(account.quota.unified7d * 100) : null;
-      console.log(`[TeamClaude] "${account.name}" near weekly quota${pct == null ? '' : ` (${pct}%)`}`);
+      console.log(`[TeamClaude] "${safeLine(account.name, 64)}" near weekly quota${pct == null ? '' : ` (${pct}%)`}`);
     }
   }
 
@@ -3351,7 +3422,7 @@ export class AccountManager {
     if (account.probing && account.quota.unified7dReset != null) {
       account.probing = false;
       account.requalify = true;
-      console.log(`[TeamClaude] Learned weekly quota for "${account.name}", re-evaluating selection`);
+      console.log(`[TeamClaude] Learned weekly quota for "${safeLine(account.name, 64)}", re-evaluating selection`);
     }
 
     // `unified-status` is upstream's verdict on THIS response. A family-cap 429
@@ -3384,14 +3455,26 @@ export class AccountManager {
     // display, projection and switch-threshold logic apply unchanged. A window
     // with no length is a bucket the plan does not have, not one at 0% used.
     // used-percent is 0-100 (not the 0-1 fraction Anthropic reports).
-    for (const window of ['primary', 'secondary']) {
-      const used = parseFloat(headers[`x-codex-${window}-used-percent`]);
-      const minutes = parseInt(headers[`x-codex-${window}-window-minutes`], 10);
-      if (isNaN(used) || !(minutes > 0)) continue;
-      const reset = parseResetAt(headers[`x-codex-${window}-reset-at`]);
-      const weekly = minutes > CODEX_WEEKLY_MIN_MINUTES;
-      account.quota[weekly ? 'unified7d' : 'unified5h'] = used / 100;
-      if (reset != null) account.quota[weekly ? 'unified7dReset' : 'unified5hReset'] = reset;
+    //
+    // Unless this account is a CONDUIT: a local proxy whose own back leg draws
+    // on the Codex accounts in this same fleet. Then the numbers it forwards
+    // belong to whichever of them served, and filing them here makes the
+    // conduit's bars a copy of the last one to answer. That is not merely a
+    // wrong readout — the conduit is the only account its route can use on the
+    // way in, so borrowing a spent account's number takes it below the switch
+    // threshold and every request fails, while a sibling sits at 0%.
+    // A standalone sidecar (no Codex accounts here) is NOT a conduit: it holds
+    // its own login, the forwarded numbers are its own, and they still apply.
+    if (!(isLocalUpstream(account) && this.accounts.some(a => providerOf(a) === 'codex'))) {
+      for (const window of ['primary', 'secondary']) {
+        const used = parseFloat(headers[`x-codex-${window}-used-percent`]);
+        const minutes = parseInt(headers[`x-codex-${window}-window-minutes`], 10);
+        if (isNaN(used) || !(minutes > 0)) continue;
+        const reset = parseResetAt(headers[`x-codex-${window}-reset-at`]);
+        const weekly = minutes > CODEX_WEEKLY_MIN_MINUTES;
+        account.quota[weekly ? 'unified7d' : 'unified5h'] = used / 100;
+        if (reset != null) account.quota[weekly ? 'unified7dReset' : 'unified5hReset'] = reset;
+      }
     }
 
     // Standard rate limits (API key accounts)
@@ -3427,7 +3510,7 @@ export class AccountManager {
         : account.quota.tokensLimit
           ? ((1 - account.quota.tokensRemaining / account.quota.tokensLimit) * 100).toFixed(1)
           : '?';
-      console.log(`[TeamClaude] Account "${account.name}" at ${pct}% usage — will switch on next request`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" at ${pct}% usage — will switch on next request`);
     }
   }
 
@@ -3520,7 +3603,7 @@ export class AccountManager {
       // drop the dead-token guard too — otherwise the account would come back
       // active but never attempt a refresh (see ensureTokenFresh).
       account._deadRefreshToken = null;
-      console.log(`[TeamClaude] Account "${account.name}" re-enabled — clearing error state`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" re-enabled — clearing error state`);
     }
   }
 
@@ -3585,7 +3668,7 @@ export class AccountManager {
       }
       // Worth a line: the account was refusing this family and is not any more.
       if (wasSpent && !(q[key] != null && q[key] >= this.thresholdFor(key))) {
-        console.log(`[TeamClaude] Account "${account.name}" ${label} weekly quota confirmed available by probe`);
+        console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" ${label} weekly quota confirmed available by probe`);
       }
     }
     // Families beyond the two with dedicated fields. Replaced wholesale rather
@@ -3609,11 +3692,11 @@ export class AccountManager {
       const was = q.spend;
       q.spend = { ...usage.spend };
       if (q.spend.enabled && !was?.enabled) {
-        console.log(`[TeamClaude] Account "${account.name}" can bill real money past its plan limits (extra usage is enabled upstream)`);
+        console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" can bill real money past its plan limits (extra usage is enabled upstream)`);
       }
       const spentNow = (q.spend.usedMinor || 0) > 0;
       if (spentNow && !((was?.usedMinor || 0) > 0)) {
-        console.log(`[TeamClaude] Account "${account.name}" has started spending real money: ${formatMoney(q.spend)}`);
+        console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" has started spending real money: ${formatMoney(q.spend)}`);
       }
     }
 
@@ -3692,7 +3775,7 @@ export class AccountManager {
     // after throttleProbeFloorMs from here, so a probe that 429s again pushes
     // the next probe out by a full floor rather than hammering upstream.
     account.throttledAt = Date.now();
-    console.log(`[TeamClaude] Account "${account.name}" rate limited for ${retryAfterSeconds}s`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" rate limited for ${retryAfterSeconds}s`);
   }
 
   /**
@@ -3706,7 +3789,7 @@ export class AccountManager {
     account.status = 'active';
     account.rateLimitedUntil = null;
     account.throttledAt = null;
-    console.log(`[TeamClaude] Account "${account.name}" revalidated — rate limit no longer applies, back in rotation`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" revalidated — rate limit no longer applies, back in rotation`);
   }
 
   /**
@@ -3743,7 +3826,7 @@ export class AccountManager {
     if (account._deadRefreshToken && account._deadRefreshToken === account.refreshToken) {
       if (account.status !== 'error') {
         account.status = 'error';
-        console.error(`[TeamClaude] Account "${account.name}" still holds a rejected refresh token — run: teamclaude login`);
+        console.error(`[TeamClaude] Account "${safeLine(account.name, 64)}" still holds a rejected refresh token — run: teamclaude login`);
       }
       return;
     }
@@ -3769,7 +3852,7 @@ export class AccountManager {
     if (account._refreshPromise) return account._refreshPromise;
 
     account._refreshPromise = (async () => {
-      console.log(`[TeamClaude] Refreshing token for account "${account.name}"...`);
+      console.log(`[TeamClaude] Refreshing token for account "${safeLine(account.name, 64)}"...`);
       // The token we SEND, captured before the await. A config reload or
       // `teamclaude import` (updateAccountTokens) can install newer tokens while
       // the grant is in flight; reading `account.refreshToken` afterwards would
@@ -3786,7 +3869,7 @@ export class AccountManager {
           ? this._codexRefreshFn(sent)
           : this._refreshFn(sent));
         if (account.refreshToken !== sent) {
-          console.log(`[TeamClaude] Discarding refresh result for account "${account.name}" — its tokens were replaced while the refresh was in flight`);
+          console.log(`[TeamClaude] Discarding refresh result for account "${safeLine(account.name, 64)}" — its tokens were replaced while the refresh was in flight`);
           return;
         }
         account.credential = newTokens.accessToken;
@@ -3794,10 +3877,10 @@ export class AccountManager {
         account.expiresAt = newTokens.expiresAt;
         account._lastRefreshAt = Date.now();
         account._deadRefreshToken = null; // this token works; clear any stale guard
-        console.log(`[TeamClaude] Token refreshed for account "${account.name}"`);
+        console.log(`[TeamClaude] Token refreshed for account "${safeLine(account.name, 64)}"`);
         this._onTokenRefresh?.(accountIndex, newTokens);
       } catch (err) {
-        console.error(`[TeamClaude] Token refresh failed for "${account.name}": ${err.message}`);
+        console.error(`[TeamClaude] Token refresh failed for "${safeLine(account.name, 64)}": ${err.message}`);
         // Reserve 'error' (which drops the account from rotation until re-login)
         // for a GENUINE auth rejection: the refresh token itself is no longer
         // valid — revoked, or invalidated by an account/plan migration. A
@@ -3813,11 +3896,11 @@ export class AccountManager {
           // a token imported mid-refresh stays untouched and gets its own try.
           account._deadRefreshToken = sent;
           if (account.refreshToken !== sent) {
-            console.log(`[TeamClaude] Account "${account.name}" received new tokens while its old refresh token was being rejected — keeping the new ones`);
+            console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" received new tokens while its old refresh token was being rejected — keeping the new ones`);
             return;
           }
           account.status = 'error';
-          console.error(`[TeamClaude] Account "${account.name}" needs re-login (refresh token rejected) — run: teamclaude login`);
+          console.error(`[TeamClaude] Account "${safeLine(account.name, 64)}" needs re-login (refresh token rejected) — run: teamclaude login`);
         }
       } finally {
         account._refreshPromise = null;
@@ -3847,7 +3930,7 @@ export class AccountManager {
     if (refreshToken) account.refreshToken = refreshToken;
     account.expiresAt = expiresAt;
     if (account.status === 'error') account.status = 'active';
-    console.log(`[TeamClaude] Updated tokens for account "${account.name}"`);
+    console.log(`[TeamClaude] Updated tokens for account "${safeLine(account.name, 64)}"`);
     this._onTokenRefresh?.(accountIndex, {
       accessToken,
       refreshToken: account.refreshToken,

package/src/codex-quota.js

@@ -67,6 +67,12 @@ function collectFamilies(headers) {
   return families;
 }
 
+/**
+ * One window reading: utilization as a 0-1 fraction, reset as ms epoch or null.
+ *
+ * @typedef {{utilization: number, resetAt: number|null}} QuotaWindow
+ */
+
 /**
  * Turn one family's windows into `{ fiveHour, weekly }` readings, keyed by the
  * window's own duration rather than its primary/secondary position.
@@ -74,8 +80,12 @@ function collectFamilies(headers) {
  * A window with no `window-minutes`, a zero duration, or an unparseable
  * utilization is dropped: a zeroed window is how this API says "not
  * applicable", and treating that as 0% used would look like full headroom.
+ *
+ * @param {Record<string, {usedPercent?: number, windowMinutes?: number, resetAt?: number}>} windows
+ * @returns {{fiveHour?: QuotaWindow, weekly?: QuotaWindow}}
  */
 function classify(windows) {
+  /** @type {{fiveHour?: QuotaWindow, weekly?: QuotaWindow}} */
   const out = {};
   for (const w of Object.values(windows)) {
     const minutes = Number(w.windowMinutes);
@@ -122,12 +132,19 @@ export function parseCodexQuota(headers) {
     if (account.weekly.resetAt) quota.unified7dReset = account.weekly.resetAt;
   }
 
-  // Model-scoped families. Their 5-hour window is not modelled separately —
-  // the manager scopes eligibility by weekly family buckets — so only the
-  // weekly reading is carried, alongside the name upstream gave it.
+  // Model-scoped families. Their weekly reading is the family bucket, carried
+  // alongside the name upstream gave it. Their 5-hour one is picked up below:
+  // on a subscription it is the only 5h this API ever states.
+  /** @type {QuotaWindow|null} */
+  let scopedFiveHour = null;
   for (const fam of families.values()) {
     if (!fam.slug) continue;
     const scoped = classify(fam.windows);
+    // Tightest wins, so the reading is taken before the weekly guard below
+    // drops a family that states a 5h window and no weekly one.
+    if (scoped.fiveHour && (!scopedFiveHour || scoped.fiveHour.utilization > scopedFiveHour.utilization)) {
+      scopedFiveHour = scoped.fiveHour;
+    }
     if (!scoped.weekly) continue;
     (quota.modelBuckets ??= []).push({
       slug: fam.slug,
@@ -137,6 +154,21 @@ export function parseCodexQuota(headers) {
     });
   }
 
+  // A subscription's account-wide family states no 5-hour window at all: it
+  // puts the 7-day one in `primary` and zeroes `secondary`, which classify()
+  // drops, correctly, because a zero-length window is how this API says "not
+  // applicable". The only 5h it states sits in a named family, and upstream
+  // returns the same one whatever model was asked for — it is the account's
+  // session window wearing a model's name. So fill the shared bucket from it
+  // when the account-wide family left it empty, and never overwrite a reading
+  // the account-wide family did give: a family bucket barring models it does
+  // not meter would be the one-way ratchet the weekly buckets take such care
+  // to avoid.
+  if (quota.unified5h == null && scopedFiveHour) {
+    quota.unified5h = scopedFiveHour.utilization;
+    if (scopedFiveHour.resetAt) quota.unified5hReset = scopedFiveHour.resetAt;
+  }
+
   return quota;
 }
 

package/src/codex-usage.js

@@ -34,6 +34,40 @@ function classify(rateLimit) {
   return { fiveHour, sevenDay };
 }
 
+/**
+ * Name each extra limit from the entry itself.
+ *
+ * A live subscription sends `additional_rate_limits` as a LIST whose entries
+ * name themselves (`metered_feature`, `limit_name`); older readings used an
+ * object keyed by the feature. `Object.entries` over a list hands back array
+ * indices, so every bucket was filed as "0" and "1" — two accounts' Spark
+ * limits collided under one meaningless key, and the header path's name for
+ * the same bucket stacked beside it rather than replacing it.
+ *
+ * `metered_feature` is that header name with a `codex_` prefix (`codex_bengalfox`
+ * here is `x-codex-bengalfox-*` there), so stripping it makes the two paths
+ * agree on one key per bucket.
+ *
+ * @param {any} additional
+ * @returns {Array<{slug: string, name: string, rateLimit: any}>}
+ */
+function additionalLimits(additional) {
+  if (Array.isArray(additional)) {
+    const out = [];
+    for (const entry of additional) {
+      if (!entry || typeof entry !== 'object') continue;
+      const feature = typeof entry.metered_feature === 'string' ? entry.metered_feature.replace(/^codex_/, '') : '';
+      const label = typeof entry.limit_name === 'string' ? entry.limit_name : '';
+      const slug = feature || label;
+      if (!slug) continue;
+      out.push({ slug, name: label || slug, rateLimit: entry.rate_limit || entry });
+    }
+    return out;
+  }
+  return Object.entries(additional || {})
+    .map(([key, value]) => ({ slug: key, name: key, rateLimit: value?.rate_limit || value }));
+}
+
 /**
  * Convert the private `/wham/usage` response into TeamClaude quota fields.
  *
@@ -43,19 +77,36 @@ export function normalizeCodexUsagePayload(data) {
   const rateLimit = data?.rate_limit || data?.rate_limits;
   const shared = classify(rateLimit);
   const modelBuckets = [];
-  for (const [name, value] of Object.entries(data?.additional_rate_limits || {})) {
-    const reading = classify(value?.rate_limit || value);
+  /** @type {{utilization: number, resetAt: number|null, seconds: number}|null} */
+  let extraFiveHour = null;
+  for (const { slug, name, rateLimit: extra } of additionalLimits(data?.additional_rate_limits)) {
+    const reading = classify(extra);
+    // Taken before the weekly guard below, so an extra limit stating a 5-hour
+    // window and no weekly one contributes its reading instead of being
+    // dropped whole. Tightest wins when several state one.
+    if (reading.fiveHour && (!extraFiveHour || reading.fiveHour.utilization > extraFiveHour.utilization)) {
+      extraFiveHour = reading.fiveHour;
+    }
     if (reading.sevenDay) {
       modelBuckets.push({
-        slug: name,
+        slug,
         name,
         utilization: reading.sevenDay.utilization,
         resetAt: reading.sevenDay.resetAt,
       });
     }
   }
+
+  // The shared `rate_limit` on a subscription states a 7-day window and a null
+  // secondary, so it yields no 5-hour reading; the only one the payload states
+  // sits in an extra limit. Fall back to that so the probe learns a session
+  // window at all, and never let it replace a shared reading: an extra limit
+  // meters the models it names, and one barring the rest would be the one-way
+  // ratchet the weekly buckets are written to avoid.
+  const fiveHour = shared.fiveHour || extraFiveHour;
+
   return {
-    fiveHour: shared.fiveHour && { utilization: shared.fiveHour.utilization, resetAt: shared.fiveHour.resetAt },
+    fiveHour: fiveHour && { utilization: fiveHour.utilization, resetAt: fiveHour.resetAt },
     sevenDay: shared.sevenDay && { utilization: shared.sevenDay.utilization, resetAt: shared.sevenDay.resetAt },
     modelBuckets,
     planType: data?.plan_type || null,

package/src/config.js

@@ -101,6 +101,7 @@ export function createDefaultConfig() {
     sessionTitles: { enabled: false, width: 18 },
     projection: { enabled: true, windowMinutes: 90, wasteFloor: 0.1 },
     eventLogging: 'hide',
+    activityLog: null,
     blockedModels: [],
     accounts: [],
   };