@rikcodes/teamclaude 1.1.20-rik.2 → 1.1.20-rik.3

package/README.md

@@ -163,9 +163,67 @@ Each request is routed by the model name in its body, so one session can freely
 2. Add a `customModels` row. Codex publishes the window for each model as `context_window` in `~/.codex/models_cache.json`; copy it to `contextTokens`.
 3. Start a new `teamclaude run` session. The rows are read at launch, so you do not need to restart the server. If you upgraded the sidecar binary, restart the server — or send `SIGTERM` to the sidecar process and let the supervisor restart it with the new binary.
 
-Claude Code prints one `[claude-code:unrecognized_model]` line to stderr for each custom model. This is expected; suppressing it would lose the correct context window. The quota bars for the sidecar account show `unknown` unless the sidecar forwards Codex's rate-limit headers — see [Quota](docs/openai.md#quota). Keep the sidecar on loopback, and use **one** ChatGPT subscription for each person. Pooling several subscriptions is the pattern that OpenAI's fraud systems target ([terms of service](docs/openai.md#terms-of-service)).
+Claude Code prints one `[claude-code:unrecognized_model]` line to stderr for each custom model. This is expected; suppressing it would lose the correct context window. The quota bars for the sidecar account show `unknown` unless the sidecar forwards Codex's rate-limit headers — see [Quota](docs/openai.md#quota). Keep the sidecar on loopback.
 
-Full details: [docs/openai.md](docs/openai.md).
+The sidecar appears under the account table as a `⚙` line rather than a row because it holds no subscription, is the only account its route can use, and never rotates. The line also shows its supervised process state (`up pid 98018`, or `down (code 1) 3 restarts`).
+
+#### Several ChatGPT accounts
+
+> **Read the [terms of service](docs/openai.md#terms-of-service) before setting this up.** OpenAI's Terms of Use prohibit rotating ChatGPT subscriptions past a spent window, and account suspension is a plausible consequence. This is a sharper trade-off than pooling Claude subscriptions because the first-party client lets you switch Claude subscriptions by hand.
+
+One sidecar holds one ChatGPT login, so GPT requests do not rotate and its quota belongs to a login that TeamClaude does not own. Point the sidecar's **back leg** at TeamClaude so native Codex accounts serve it instead:
+
+```
+Claude Code ──▶ TC /v1/messages (gpt-*) ──▶ sidecar account ──▶ sidecar translates
+            ──▶ TC /backend-api/codex/responses ──▶ ChatGPT account pool ──▶ chatgpt.com
+```
+
+Each hop is classified by its path, and the subscription partition keeps the pools apart: on the way in only the sidecar account is eligible, on the way back only the ChatGPT accounts. One route lists both.
+
+**1. Add the accounts** — run `teamclaude login --codex` once for each one. A Codex login takes its email as its name. Your Anthropic account probably uses the same name, so the Codex name gets a prefix to keep it unambiguous:
+
+```
+$ teamclaude login --codex
+Named "codex:you@example.com" — "you@example.com" is already an account on another provider.
+```
+
+**2. Redirect the sidecar** and stub its own login, so TeamClaude supplies the credential instead:
+
+```json
+{ "name": "codex",
+  "command": ["claude-code-proxy", "serve", "--no-monitor", "--port", "18765"],
+  "env": {
+    "CCP_CODEX_BASE_URL": "http://127.0.0.1:3456/backend-api/codex/responses",
+    "CCP_CODEX_TRANSPORT": "http"
+  } }
+```
+
+```bash
+cd ~/.config/claude-code-proxy/codex
+cp auth.json auth.json.bak                      # the real login — keep it
+echo '{ "access": "delegated-to-teamclaude", "refresh": "", "expires": 4102444800000 }' > auth.json
+```
+
+The sidecar refuses to start with an empty store but never refreshes a far-future token, and TeamClaude replaces both the bearer and the account header on the way out. Leave `accountId` unset so none of the sidecar's own identity can leak.
+
+**3. Put them all on the `gpt-*` route**, sidecar included, and give each account a `headersTimeoutMs` — the 120s fleet default is shorter than a long reasoning turn:
+
+```json
+{ "name": "codex", "match": ["gpt-*"],
+  "accounts": ["codex", "codex:you@example.com", "codex:you@work.example"] }
+```
+
+**4. Restart the server.** A `sidecars[].env` change is read once at startup, so a reload is not enough.
+
+Three details matter:
+
+- **Leave the sidecar account on the route.** It can look removable because it is not a subscription or an account row, but it is the routing target for the way *in*. Without it, every `gpt-*` request fails to find an account while `teamclaude status` shows two healthy ChatGPT accounts on the route.
+- **`CCP_CODEX_TRANSPORT=http` is required.** A WebSocket upgrade is relayed with the caller's own headers and draws no account, so the WebSocket transport cannot be pooled.
+- **Do not reuse a name across providers.** Routes address accounts by name, so a shared name admits both — including the Claude account that cannot serve `gpt-*`, which outranks the sidecar on priority and wins. TeamClaude warns at startup when it sees one.
+
+Two things differ from the single-account setup: each turn appears **twice** in the activity list, once per hop, and tokens are booked against the sidecar account, so a ChatGPT account reads `N req · 0 tok`. Its quota bars are unaffected because they come from the `x-codex-*` headers on the second hop, where the subscription is.
+
+Full details, including what happens to quota on each hop: [Several ChatGPT accounts behind one sidecar](docs/openai.md#several-chatgpt-accounts-behind-one-sidecar).
 
 ### Burn-rate projection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.20-rik.2",
+  "version": "1.1.20-rik.3",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,5 +1,5 @@
 import { refreshAccessToken, isTokenExpiringSoon, isTokenExpired, formatMoney } from './oauth.js';
-import { providerOf, DEFAULT_PROVIDER, isSubscriptionAccount } from './provider.js';
+import { providerOf, DEFAULT_PROVIDER, isSubscriptionAccount, isLocalUpstream } from './provider.js';
 import { refreshCodexToken } from './codex-auth.js';
 import { parseCodexQuota, parseCodexPlanType } from './codex-quota.js';
 import { sameIdentity } from './identity.js';
@@ -2699,14 +2699,27 @@ export class AccountManager {
   }
 
   /** Accounts a configured route can use (all accounts when it lists none), each
-   * with a live eligibility flag for a representative model of the route. */
+   * with a live eligibility flag for a representative model of the route and the
+   * provider that will serve it.
+   *
+   * A route that NAMES its accounts is shown in full, whatever provider each one
+   * belongs to. One route legitimately spans two: a translating sidecar reached
+   * on the Anthropic wire, plus the subscription pool its own back leg re-enters
+   * on the provider's path. Both hops are that route's traffic. Filtering the
+   * view by a single provider hid the second set completely — the route looked
+   * like it listed one account, and a newly added subscription that nobody had
+   * added to the list was invisible rather than merely idle, which is the exact
+   * shape of the diagnosis this view exists to prevent.
+   *
+   * A route that lists NOBODY is different: it constrains models, not accounts,
+   * so only the asking provider's own pool can serve it and the partition still
+   * applies. */
   _routeAccountsView(route, provider = DEFAULT_PROVIDER) {
     const sample = sampleModelFor(route);
-    const excluded = this._excludeOtherProviders(null, provider);
-    const inRoute = a => !route.accounts.length
-      || route.accounts.includes(a.name) || route.accounts.includes(String(a.index));
-    return this.accounts.filter(a => inRoute(a) && !excluded?.has(a.index))
-      .map(a => ({ name: a.name, eligible: this._isAvailable(a, sample) }));
+    const listed = route.accounts.length
+      ? this.accounts.filter(a => route.accounts.includes(a.name) || route.accounts.includes(String(a.index)))
+      : this.accounts.filter(a => !this._excludeOtherProviders(null, provider)?.has(a.index));
+    return listed.map(a => ({ name: a.name, provider: providerOf(a), eligible: this._isAvailable(a, sample) }));
   }
 
   /** A representative model id for a route name (configured or auto fable/sonnet),
@@ -3384,14 +3397,26 @@ export class AccountManager {
     // display, projection and switch-threshold logic apply unchanged. A window
     // with no length is a bucket the plan does not have, not one at 0% used.
     // used-percent is 0-100 (not the 0-1 fraction Anthropic reports).
-    for (const window of ['primary', 'secondary']) {
-      const used = parseFloat(headers[`x-codex-${window}-used-percent`]);
-      const minutes = parseInt(headers[`x-codex-${window}-window-minutes`], 10);
-      if (isNaN(used) || !(minutes > 0)) continue;
-      const reset = parseResetAt(headers[`x-codex-${window}-reset-at`]);
-      const weekly = minutes > CODEX_WEEKLY_MIN_MINUTES;
-      account.quota[weekly ? 'unified7d' : 'unified5h'] = used / 100;
-      if (reset != null) account.quota[weekly ? 'unified7dReset' : 'unified5hReset'] = reset;
+    //
+    // Unless this account is a CONDUIT: a local proxy whose own back leg draws
+    // on the Codex accounts in this same fleet. Then the numbers it forwards
+    // belong to whichever of them served, and filing them here makes the
+    // conduit's bars a copy of the last one to answer. That is not merely a
+    // wrong readout — the conduit is the only account its route can use on the
+    // way in, so borrowing a spent account's number takes it below the switch
+    // threshold and every request fails, while a sibling sits at 0%.
+    // A standalone sidecar (no Codex accounts here) is NOT a conduit: it holds
+    // its own login, the forwarded numbers are its own, and they still apply.
+    if (!(isLocalUpstream(account) && this.accounts.some(a => providerOf(a) === 'codex'))) {
+      for (const window of ['primary', 'secondary']) {
+        const used = parseFloat(headers[`x-codex-${window}-used-percent`]);
+        const minutes = parseInt(headers[`x-codex-${window}-window-minutes`], 10);
+        if (isNaN(used) || !(minutes > 0)) continue;
+        const reset = parseResetAt(headers[`x-codex-${window}-reset-at`]);
+        const weekly = minutes > CODEX_WEEKLY_MIN_MINUTES;
+        account.quota[weekly ? 'unified7d' : 'unified5h'] = used / 100;
+        if (reset != null) account.quota[weekly ? 'unified7dReset' : 'unified5hReset'] = reset;
+      }
     }
 
     // Standard rate limits (API key accounts)

package/src/identity.js

@@ -188,3 +188,48 @@ export function oauthIdentityFields(profile) {
       .map(key => [key, profile[key]])
   );
 }
+
+/**
+ * Names held by more than one account, with the providers that hold each.
+ *
+ * `name` is this proxy's ADDRESSING key — routes name accounts by it
+ * (`_routeAllows`), so do `TC_ACCT`, the `/tc-acct/` pin, `teamclaude disable`
+ * and the TUI pickers. Identity, by contrast, is deliberately provider-aware:
+ * `sameIdentity` treats two providers as separate plans, so signing the same
+ * person's email into Anthropic and into Codex correctly yields two accounts.
+ *
+ * Those two rules meet badly. Two distinct accounts sharing a name make every
+ * name-addressed lookup ambiguous, and the lookups do not agree with each other
+ * about which one they mean: `_routeAllows` admits BOTH, while
+ * `resolveAccountPin` takes the first. Listing a shared name in a route
+ * therefore quietly admits an account that cannot serve the request — and when
+ * that account outranks the intended one on priority, it wins.
+ *
+ * Detection only. Nothing here refuses a config: an operator who wants two rows
+ * called the same thing may have a reason, and a proxy that will not start is
+ * worse than one that says what is wrong.
+ *
+ * @param {Array<{name?: string}>} accounts
+ * @returns {Array<{name: string, providers: string[]}>}
+ */
+export function duplicateAccountNames(accounts = []) {
+  const byName = new Map();
+  for (const a of accounts) {
+    const name = a?.name;
+    if (typeof name !== 'string' || !name) continue;
+    if (!byName.has(name)) byName.set(name, []);
+    byName.get(name).push(providerOf(a));
+  }
+  return [...byName.entries()]
+    .filter(([, providers]) => providers.length > 1)
+    .map(([name, providers]) => ({ name, providers }));
+}
+
+/** The duplicate-name warning lines for `accounts`, or [] when there are none. */
+export function duplicateNameWarnings(accounts = []) {
+  return duplicateAccountNames(accounts).map(({ name, providers }) =>
+    `[TeamClaude] Two accounts are named "${name}" (${providers.join(', ')}). `
+    + 'Routes, TC_ACCT and `teamclaude disable` address accounts by name, so this one is '
+    + 'ambiguous: a route listing it admits both, including the one that cannot serve the '
+    + 'request. Rename one (e.g. "codex:' + name + '").');
+}

package/src/index.js

@@ -18,8 +18,7 @@ import {
   findUpsertTarget,
   updateAccountEntry,
   canUpsertOAuthAccount,
-  oauthIdentityFields,
-} from './identity.js';
+  oauthIdentityFields, duplicateNameWarnings } from './identity.js';
 import { resolveAccounts } from './resolve-accounts.js';
 import { loginCodex } from './codex-auth.js';
 import { syncAccountsFromDisk } from './sync-accounts.js';
@@ -286,6 +285,11 @@ async function serverCommand() {
     console.error(`[TeamClaude] Bad adaptiveDistribution setting in ${getConfigPath()}: ${err.message}`);
     process.exit(1);
   }
+  // Name is the addressing key for routes, TC_ACCT and the CLI, while identity
+  // is provider-aware — so the same email on two providers is two accounts with
+  // one name, and every name lookup becomes ambiguous. Said once at startup and
+  // again after a reload, never fatal.
+  for (const line of duplicateNameWarnings(accounts)) console.error(line);
   const accountManager = new AccountManager(accounts, threshold, { routes: config.routes, ramp: config.stormRamp, distributeSessions: config.distributeSessions, projection: config.projection, expiryRouting: config.expiryRouting, adaptive });
   // Names the activity log's session column from Claude Code's own on-disk
   // session titles. Built whether or not the TUI runs, so a reload has one
@@ -392,6 +396,7 @@ async function serverCommand() {
     const diskConfig = await loadConfig();
     if (!diskConfig) return 0;
     const added = await syncAccountsFromDisk(diskConfig, config, accountManager);
+    for (const line of duplicateNameWarnings(accountManager.accounts)) console.error(line);
     // Pick up client-key edits (proxy.clientKeys is read live by both auth
     // gates through the shared config object, so refreshing it here is all a
     // key add/rotate/revoke needs — no restart).
@@ -497,6 +502,9 @@ async function serverCommand() {
         if (config.routes != null) diskConfig.routes = config.routes;
       }),
       syncAccounts: reloadAccounts,
+      // Read through to the live supervisor rather than snapshotting: it
+      // respawns on its own schedule and the TUI redraws on a timer.
+      getSidecars: () => sidecar?.getStatus() || [],
       // `p` key: on-demand fleet-wide quota refresh. The prober is constructed
       // after the TUI, so this is a thunk over the closure variable.
       probeQuota: () => prober?.probeAll(),
@@ -804,8 +812,21 @@ async function loginCodexCommand() {
   // account would fail on its next restart. So the upsert runs against a fresh
   // read of the file, and only this account's row is touched.
   await atomicConfigUpdate(config => {
-    const name = argValue('--name') || creds.email
+    // A Codex login is named for its email, and the same person's Anthropic
+    // account is named for the same email — so the default collides by default.
+    // Name is the addressing key (routes, TC_ACCT, `disable`), and a route
+    // listing an ambiguous name admits BOTH accounts, including the one that
+    // cannot serve the request. Prefix rather than refuse: the operator asked
+    // for this login, and a name they did not choose is a smaller surprise than
+    // a failed command. An explicit --name is theirs and is left alone.
+    const preferred = creds.email
       || `codex-${config.accounts.filter(a => a.provider === 'codex').length + 1}`;
+    const takenByOther = (n) => config.accounts.some(a => a.name === n && a.provider !== 'codex');
+    const name = argValue('--name')
+      || (takenByOther(preferred) ? `codex:${preferred}` : preferred);
+    if (!argValue('--name') && name !== preferred) {
+      console.log(`Named "${name}" — "${preferred}" is already an account on another provider.`);
+    }
 
     const account = {
       name,

package/src/provider.js

@@ -169,6 +169,12 @@ export function applyAuthHeaders(headers, account) {
   const provider = providerOf(account);
   if (provider === 'codex') {
     headers['authorization'] = `Bearer ${account.credential}`;
+    // Cleared before it is set, not merely overwritten. `authorization` is
+    // stripped from every inbound request, but this header is not — so a
+    // caller that sends one of its own (a translating sidecar does, from its
+    // own local login) would have it survive for an account that carries no
+    // accountId, pairing THIS account's token with THAT caller's account id.
+    delete headers['chatgpt-account-id'];
     if (account.accountId) headers['chatgpt-account-id'] = account.accountId;
     return;
   }

package/src/server.js

@@ -801,13 +801,15 @@ const SESSION_ID_SHAPE = /^[A-Za-z0-9._-]{1,128}$/;
 /** The session id a request carries, or null when the header is absent or
  *  malformed — a malformed one is treated as no session, not rejected.
  *
- *  Claude Code sends `x-claude-code-session-id`, the Codex CLI `session-id`.
- *  Reading only the first left every Codex request untagged, so
- *  `distributeSessions` had nothing to place and a Codex pool stayed on one
- *  account until the switch threshold. The specific header wins when both are
- *  present: `session-id` is generic enough for a proxy in front to set. */
+ *  Claude Code sends `x-claude-code-session-id`, the Codex CLI `session-id`,
+ *  and a translating sidecar re-emits the session it was given as `session_id`
+ *  (the spelling the Codex backend itself uses). Reading only the first left
+ *  every Codex request untagged, so `distributeSessions` had nothing to place
+ *  and a Codex pool stayed on one account until the switch threshold. Order is
+ *  most-specific first: the underscore form is the one a sidecar writes on our
+ *  behalf, and `session-id` is generic enough for a proxy in front to set. */
 export function clientSessionId(headers) {
-  const raw = headers['x-claude-code-session-id'] ?? headers['session-id'];
+  const raw = headers['x-claude-code-session-id'] ?? headers['session-id'] ?? headers['session_id'];
   return typeof raw === 'string' && SESSION_ID_SHAPE.test(raw) ? raw : null;
 }
 

package/src/status-renderer.js

@@ -211,10 +211,19 @@ function routingLines(routes, blocked, paint) {
     // say so, rather than listing eligible accounts it will never reach.
     const routeBlocked = globs.length > 0
       && globs.every(g => blocked.some(p => modelGlobOverlaps(p, g)));
+    // A route may list accounts from two providers — a local translating sidecar
+    // on this route's own wire, plus the subscription pool its back leg reaches.
+    // Tag the ones that are not this route's own provider, so a mixed row says
+    // which hop each account serves instead of reading as one flat pool.
+    const routeProvider = route.provider || 'anthropic';
+    const accountText = (a) => {
+      const tag = a.provider && a.provider !== routeProvider ? `:${nameText(a.provider)}` : '';
+      return nameText(a.name) + tag;
+    };
     const accounts = routeBlocked
       ? paint.red('blocked')
       : (route.accounts || [])
-        .map(a => (a.eligible ? paint.green(nameText(a.name)) : paint.red(nameText(a.name)))).join(' ') || paint.gray('(none)');
+        .map(a => (a.eligible ? paint.green(accountText(a)) : paint.red(accountText(a)))).join(' ') || paint.gray('(none)');
     const tag = route.autocreated ? paint.dim(' (auto)') : route.bucket ? paint.dim(` [${nameText(route.bucket)}]`) : '';
     const pin = route.pinned ? paint.dim(` [pinned: ${nameText(route.pinned)}]`) : '';
     // padEnd on the raw text, color after, so ANSI codes don't throw off alignment.

package/src/tui-remote.js

@@ -264,7 +264,21 @@ export class RemoteAccountManager {
       target: r?.target == null ? r?.target : text(r.target, NAME_MAX),
       match: (Array.isArray(r?.match) ? r.match : []).map(g => text(g, 64)).filter(Boolean),
       accounts: (Array.isArray(r?.accounts) ? r.accounts : [])
-        .map(a => ({ ...a, name: text(a?.name, NAME_MAX, '?'), eligible: !!a?.eligible })),
+        .map(a => ({
+          ...a,
+          name: text(a?.name, NAME_MAX, '?'),
+          provider: a?.provider == null ? a?.provider : text(a.provider, 16),
+          eligible: !!a?.eligible,
+        })),
+    }));
+    // Conduit lines read this. Clamped like every other remote field: the
+    // payload is a server's word, not ours, and it reaches a rendered line.
+    this.sidecars = (Array.isArray(status?.sidecars) ? status.sidecars : []).map(sc => ({
+      name: text(sc?.name, NAME_MAX, '?'),
+      running: !!sc?.running,
+      pid: Number.isFinite(sc?.pid) ? sc.pid : null,
+      restarts: Number.isFinite(sc?.restarts) ? sc.restarts : 0,
+      lastExit: sc?.lastExit == null ? null : text(sc.lastExit, 48),
     }));
     this.status = status;
     this.connected = true;

package/src/tui.js

@@ -405,6 +405,9 @@ function timestamp() {
 
 export class TUI {
   constructor({ accountManager, config, saveConfig, syncAccounts, onQuit, sx = null, probeQuota = null, activityLogPath = null,
+    // Supervised sidecar state for the conduit lines. A getter, not a snapshot:
+    // the supervisor respawns on its own schedule and the TUI redraws on a timer.
+    getSidecars = null,
     // Attach mode: the accounts belong to a server in another process, reached
     // over its control plane. Everything that would mutate local state is off,
     // and a switch becomes a request (applySwitch) instead of an assignment.
@@ -429,6 +432,7 @@ export class TUI {
     this.sx = sx;            // sx.org proxy manager (may be null)
     this.sxBalance = null;   // last fetched sx.org balance, for the settings screen
     this.probeQuota = probeQuota; // on-demand fleet-wide quota refresh (may be null)
+    this.getSidecars = getSidecars; // supervised sidecar state (may be null)
     this.activityLogPath = activityLogPath;
     this._readCredentials = readCredentials;
     this._readProfile = readProfile;
@@ -1519,6 +1523,8 @@ export class TUI {
         const b = budgets.get(categoryOf(this.am.accounts[i]));
         lines.push(this._renderAcct(i, b.bw, b.showBoth, routes, genRoutes, familyTarget, b.showFamily, nameW));
       }
+      // Local backends sit under the seats, as a readout rather than rows.
+      lines.push(...this._conduitLines());
     }
 
     // Routing is surfaced inline on each account row (see _renderAcct): a colored
@@ -1570,14 +1576,15 @@ export class TUI {
     this._paint(buf, force);
   }
 
-  /** Manager indices in the order the rows are drawn: accounts served by a
-   *  local process last, every other account left where it is.
+  /** Manager indices of the accounts drawn as rows: the seats that rotate.
    *
-   *  A local backend (a translating proxy in front of another vendor, say) is
-   *  infrastructure rather than a seat to rotate between, so it reads as noise
-   *  wedged among the accounts that do rotate. Config order cannot keep it out
-   *  of the way on its own, because a newly added account is appended AFTER it
-   *  and puts it back in the middle.
+   *  A local backend — a translating proxy in front of another vendor — is
+   *  infrastructure, not a seat. It holds no subscription (its token is a
+   *  placeholder), it is the only candidate its route has, so it never rotates,
+   *  and it has no quota of its own to show. Drawn among the accounts it was a
+   *  row of dashes and borrowed numbers in a table whose whole purpose is which
+   *  account is being spent. It gets its own line below instead — see
+   *  _conduitLines. Sorting it last was the first half of this thought.
    *
    *  Display only. `selIdx`, `currentIndex`, session pins and route entries all
    *  stay manager indices, so nothing about selection or routing moves with the
@@ -1586,11 +1593,44 @@ export class TUI {
   _displayOrder() {
     return this.am.accounts
       .map((_, i) => i)
-      .sort((x, y) => {
-        const sx = isLocalUpstream(this.am.accounts[x]) ? 1 : 0;
-        const sy = isLocalUpstream(this.am.accounts[y]) ? 1 : 0;
-        return sx - sy || x - y; // ties keep list order, so the sort is stable
-      });
+      .filter(i => !isLocalUpstream(this.am.accounts[i]));
+  }
+
+  /** Manager indices of the local backends, in config order. */
+  _conduitOrder() {
+    return this.am.accounts.map((_, i) => i).filter(i => isLocalUpstream(this.am.accounts[i]));
+  }
+
+  /** One line per local backend: what it is, where it sends, and whether it can
+   *  serve. Its supervised process's state is folded in when this TUI has it
+   *  (the server passes a getter; the remote TUI reads the status payload), so
+   *  a crash-looping sidecar says so here rather than only in `status --json`.
+   *
+   *  Deliberately terse. There is nothing to choose between, so this is a
+   *  readout, not a row: the operator needs "is it up" and nothing else. */
+  _conduitLines() {
+    const sidecars = this._sidecars();
+    return this._conduitOrder().map(i => {
+      const a = this.am.accounts[i];
+      let host = a.upstream;
+      try { host = new URL(a.upstream).host; } catch { /* keep the raw string */ }
+      // Matched by name: a sidecars[] entry and the account that routes to it
+      // are named by the same operator, and nothing else pairs them.
+      const proc = sidecars.find(sc => sc.name === a.name) || null;
+      const state = a.disabled ? red('disabled')
+        : a.rateLimitedUntil > Date.now() ? yellow('throttled')
+          : proc && !proc.running ? red(`down (${proc.lastExit || 'restarting'})`)
+            : proc ? green('up') : green('ok');
+      const pid = proc?.running ? dim(` pid ${proc.pid}`) : '';
+      const restarts = proc?.restarts ? yellow(` ${proc.restarts} restarts`) : '';
+      return ` ${dim('⚙')} ${a.name} ${dim('→')} ${dim(host)}  ${state}${pid}${restarts}`;
+    });
+  }
+
+  /** Supervised sidecar state, or [] when this TUI has no view of it. */
+  _sidecars() {
+    const list = this.getSidecars ? this.getSidecars() : this.am.sidecars;
+    return Array.isArray(list) ? list : [];
   }
 
   _renderAcct(idx, bw, showBoth, routes = this.am.getRoutes(), genRoutes = routes.filter(r => routeFamily(r) === null), familyTarget = {}, showFamily = true, nameW = NAME_MIN) {