@rikcodes/teamclaude 1.1.20-rik.2 → 1.1.20-rik.4

package/README.md

@@ -163,9 +163,67 @@ Each request is routed by the model name in its body, so one session can freely
 2. Add a `customModels` row. Codex publishes the window for each model as `context_window` in `~/.codex/models_cache.json`; copy it to `contextTokens`.
 3. Start a new `teamclaude run` session. The rows are read at launch, so you do not need to restart the server. If you upgraded the sidecar binary, restart the server — or send `SIGTERM` to the sidecar process and let the supervisor restart it with the new binary.
 
-Claude Code prints one `[claude-code:unrecognized_model]` line to stderr for each custom model. This is expected; suppressing it would lose the correct context window. The quota bars for the sidecar account show `unknown` unless the sidecar forwards Codex's rate-limit headers — see [Quota](docs/openai.md#quota). Keep the sidecar on loopback, and use **one** ChatGPT subscription for each person. Pooling several subscriptions is the pattern that OpenAI's fraud systems target ([terms of service](docs/openai.md#terms-of-service)).
+Claude Code prints one `[claude-code:unrecognized_model]` line to stderr for each custom model. This is expected; suppressing it would lose the correct context window. The quota bars for the sidecar account show `unknown` unless the sidecar forwards Codex's rate-limit headers — see [Quota](docs/openai.md#quota). Keep the sidecar on loopback.
 
-Full details: [docs/openai.md](docs/openai.md).
+The sidecar appears under the account table as a `⚙` line rather than a row because it holds no subscription, is the only account its route can use, and never rotates. The line also shows its supervised process state (`up pid 98018`, or `down (code 1) 3 restarts`).
+
+#### Several ChatGPT accounts
+
+> **Read the [terms of service](docs/openai.md#terms-of-service) before setting this up.** OpenAI's Terms of Use prohibit rotating ChatGPT subscriptions past a spent window, and account suspension is a plausible consequence. This is a sharper trade-off than pooling Claude subscriptions because the first-party client lets you switch Claude subscriptions by hand.
+
+One sidecar holds one ChatGPT login, so GPT requests do not rotate and its quota belongs to a login that TeamClaude does not own. Point the sidecar's **back leg** at TeamClaude so native Codex accounts serve it instead:
+
+```
+Claude Code ──▶ TC /v1/messages (gpt-*) ──▶ sidecar account ──▶ sidecar translates
+            ──▶ TC /backend-api/codex/responses ──▶ ChatGPT account pool ──▶ chatgpt.com
+```
+
+Each hop is classified by its path, and the subscription partition keeps the pools apart: on the way in only the sidecar account is eligible, on the way back only the ChatGPT accounts. One route lists both.
+
+**1. Add the accounts** — run `teamclaude login --codex` once for each one. A Codex login takes its email as its name. Your Anthropic account probably uses the same name, so the Codex name gets a prefix to keep it unambiguous:
+
+```
+$ teamclaude login --codex
+Named "codex:you@example.com" — "you@example.com" is already an account on another provider.
+```
+
+**2. Redirect the sidecar** and stub its own login, so TeamClaude supplies the credential instead:
+
+```json
+{ "name": "codex",
+  "command": ["claude-code-proxy", "serve", "--no-monitor", "--port", "18765"],
+  "env": {
+    "CCP_CODEX_BASE_URL": "http://127.0.0.1:3456/backend-api/codex/responses",
+    "CCP_CODEX_TRANSPORT": "http"
+  } }
+```
+
+```bash
+cd ~/.config/claude-code-proxy/codex
+cp auth.json auth.json.bak                      # the real login — keep it
+echo '{ "access": "delegated-to-teamclaude", "refresh": "", "expires": 4102444800000 }' > auth.json
+```
+
+The sidecar refuses to start with an empty store but never refreshes a far-future token, and TeamClaude replaces both the bearer and the account header on the way out. Leave `accountId` unset so none of the sidecar's own identity can leak.
+
+**3. Put them all on the `gpt-*` route**, sidecar included, and give each account a `headersTimeoutMs` — the 120s fleet default is shorter than a long reasoning turn:
+
+```json
+{ "name": "codex", "match": ["gpt-*"],
+  "accounts": ["codex", "codex:you@example.com", "codex:you@work.example"] }
+```
+
+**4. Restart the server.** A `sidecars[].env` change is read once at startup, so a reload is not enough.
+
+Three details matter:
+
+- **Leave the sidecar account on the route.** It can look removable because it is not a subscription or an account row, but it is the routing target for the way *in*. Without it, every `gpt-*` request fails to find an account while `teamclaude status` shows two healthy ChatGPT accounts on the route.
+- **`CCP_CODEX_TRANSPORT=http` is required.** A WebSocket upgrade is relayed with the caller's own headers and draws no account, so the WebSocket transport cannot be pooled.
+- **Do not reuse a name across providers.** Routes address accounts by name, so a shared name admits both — including the Claude account that cannot serve `gpt-*`, which outranks the sidecar on priority and wins. TeamClaude warns at startup when it sees one.
+
+Two things differ from the single-account setup: each turn appears **twice** in the activity list, once per hop, and tokens are booked against the sidecar account, so a ChatGPT account reads `N req · 0 tok`. Its quota bars are unaffected because they come from the `x-codex-*` headers on the second hop, where the subscription is.
+
+Full details, including what happens to quota on each hop: [Several ChatGPT accounts behind one sidecar](docs/openai.md#several-chatgpt-accounts-behind-one-sidecar).
 
 ### Burn-rate projection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.20-rik.2",
+  "version": "1.1.20-rik.4",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,5 +1,5 @@
 import { refreshAccessToken, isTokenExpiringSoon, isTokenExpired, formatMoney } from './oauth.js';
-import { providerOf, DEFAULT_PROVIDER, isSubscriptionAccount } from './provider.js';
+import { providerOf, DEFAULT_PROVIDER, isSubscriptionAccount, isLocalUpstream } from './provider.js';
 import { refreshCodexToken } from './codex-auth.js';
 import { parseCodexQuota, parseCodexPlanType } from './codex-quota.js';
 import { sameIdentity } from './identity.js';
@@ -2699,14 +2699,27 @@ export class AccountManager {
   }
 
   /** Accounts a configured route can use (all accounts when it lists none), each
-   * with a live eligibility flag for a representative model of the route. */
+   * with a live eligibility flag for a representative model of the route and the
+   * provider that will serve it.
+   *
+   * A route that NAMES its accounts is shown in full, whatever provider each one
+   * belongs to. One route legitimately spans two: a translating sidecar reached
+   * on the Anthropic wire, plus the subscription pool its own back leg re-enters
+   * on the provider's path. Both hops are that route's traffic. Filtering the
+   * view by a single provider hid the second set completely — the route looked
+   * like it listed one account, and a newly added subscription that nobody had
+   * added to the list was invisible rather than merely idle, which is the exact
+   * shape of the diagnosis this view exists to prevent.
+   *
+   * A route that lists NOBODY is different: it constrains models, not accounts,
+   * so only the asking provider's own pool can serve it and the partition still
+   * applies. */
   _routeAccountsView(route, provider = DEFAULT_PROVIDER) {
     const sample = sampleModelFor(route);
-    const excluded = this._excludeOtherProviders(null, provider);
-    const inRoute = a => !route.accounts.length
-      || route.accounts.includes(a.name) || route.accounts.includes(String(a.index));
-    return this.accounts.filter(a => inRoute(a) && !excluded?.has(a.index))
-      .map(a => ({ name: a.name, eligible: this._isAvailable(a, sample) }));
+    const listed = route.accounts.length
+      ? this.accounts.filter(a => route.accounts.includes(a.name) || route.accounts.includes(String(a.index)))
+      : this.accounts.filter(a => !this._excludeOtherProviders(null, provider)?.has(a.index));
+    return listed.map(a => ({ name: a.name, provider: providerOf(a), eligible: this._isAvailable(a, sample) }));
   }
 
   /** A representative model id for a route name (configured or auto fable/sonnet),
@@ -3384,14 +3397,26 @@ export class AccountManager {
     // display, projection and switch-threshold logic apply unchanged. A window
     // with no length is a bucket the plan does not have, not one at 0% used.
     // used-percent is 0-100 (not the 0-1 fraction Anthropic reports).
-    for (const window of ['primary', 'secondary']) {
-      const used = parseFloat(headers[`x-codex-${window}-used-percent`]);
-      const minutes = parseInt(headers[`x-codex-${window}-window-minutes`], 10);
-      if (isNaN(used) || !(minutes > 0)) continue;
-      const reset = parseResetAt(headers[`x-codex-${window}-reset-at`]);
-      const weekly = minutes > CODEX_WEEKLY_MIN_MINUTES;
-      account.quota[weekly ? 'unified7d' : 'unified5h'] = used / 100;
-      if (reset != null) account.quota[weekly ? 'unified7dReset' : 'unified5hReset'] = reset;
+    //
+    // Unless this account is a CONDUIT: a local proxy whose own back leg draws
+    // on the Codex accounts in this same fleet. Then the numbers it forwards
+    // belong to whichever of them served, and filing them here makes the
+    // conduit's bars a copy of the last one to answer. That is not merely a
+    // wrong readout — the conduit is the only account its route can use on the
+    // way in, so borrowing a spent account's number takes it below the switch
+    // threshold and every request fails, while a sibling sits at 0%.
+    // A standalone sidecar (no Codex accounts here) is NOT a conduit: it holds
+    // its own login, the forwarded numbers are its own, and they still apply.
+    if (!(isLocalUpstream(account) && this.accounts.some(a => providerOf(a) === 'codex'))) {
+      for (const window of ['primary', 'secondary']) {
+        const used = parseFloat(headers[`x-codex-${window}-used-percent`]);
+        const minutes = parseInt(headers[`x-codex-${window}-window-minutes`], 10);
+        if (isNaN(used) || !(minutes > 0)) continue;
+        const reset = parseResetAt(headers[`x-codex-${window}-reset-at`]);
+        const weekly = minutes > CODEX_WEEKLY_MIN_MINUTES;
+        account.quota[weekly ? 'unified7d' : 'unified5h'] = used / 100;
+        if (reset != null) account.quota[weekly ? 'unified7dReset' : 'unified5hReset'] = reset;
+      }
     }
 
     // Standard rate limits (API key accounts)

package/src/identity.js

@@ -188,3 +188,48 @@ export function oauthIdentityFields(profile) {
       .map(key => [key, profile[key]])
   );
 }
+
+/**
+ * Names held by more than one account, with the providers that hold each.
+ *
+ * `name` is this proxy's ADDRESSING key — routes name accounts by it
+ * (`_routeAllows`), so do `TC_ACCT`, the `/tc-acct/` pin, `teamclaude disable`
+ * and the TUI pickers. Identity, by contrast, is deliberately provider-aware:
+ * `sameIdentity` treats two providers as separate plans, so signing the same
+ * person's email into Anthropic and into Codex correctly yields two accounts.
+ *
+ * Those two rules meet badly. Two distinct accounts sharing a name make every
+ * name-addressed lookup ambiguous, and the lookups do not agree with each other
+ * about which one they mean: `_routeAllows` admits BOTH, while
+ * `resolveAccountPin` takes the first. Listing a shared name in a route
+ * therefore quietly admits an account that cannot serve the request — and when
+ * that account outranks the intended one on priority, it wins.
+ *
+ * Detection only. Nothing here refuses a config: an operator who wants two rows
+ * called the same thing may have a reason, and a proxy that will not start is
+ * worse than one that says what is wrong.
+ *
+ * @param {Array<{name?: string}>} accounts
+ * @returns {Array<{name: string, providers: string[]}>}
+ */
+export function duplicateAccountNames(accounts = []) {
+  const byName = new Map();
+  for (const a of accounts) {
+    const name = a?.name;
+    if (typeof name !== 'string' || !name) continue;
+    if (!byName.has(name)) byName.set(name, []);
+    byName.get(name).push(providerOf(a));
+  }
+  return [...byName.entries()]
+    .filter(([, providers]) => providers.length > 1)
+    .map(([name, providers]) => ({ name, providers }));
+}
+
+/** The duplicate-name warning lines for `accounts`, or [] when there are none. */
+export function duplicateNameWarnings(accounts = []) {
+  return duplicateAccountNames(accounts).map(({ name, providers }) =>
+    `[TeamClaude] Two accounts are named "${name}" (${providers.join(', ')}). `
+    + 'Routes, TC_ACCT and `teamclaude disable` address accounts by name, so this one is '
+    + 'ambiguous: a route listing it admits both, including the one that cannot serve the '
+    + 'request. Rename one (e.g. "codex:' + name + '").');
+}

package/src/index.js

@@ -18,8 +18,8 @@ import {
   findUpsertTarget,
   updateAccountEntry,
   canUpsertOAuthAccount,
-  oauthIdentityFields,
-} from './identity.js';
+  oauthIdentityFields, duplicateNameWarnings } from './identity.js';
+import { routeReachabilityWarnings } from './route-warnings.js';
 import { resolveAccounts } from './resolve-accounts.js';
 import { loginCodex } from './codex-auth.js';
 import { syncAccountsFromDisk } from './sync-accounts.js';
@@ -286,6 +286,15 @@ async function serverCommand() {
     console.error(`[TeamClaude] Bad adaptiveDistribution setting in ${getConfigPath()}: ${err.message}`);
     process.exit(1);
   }
+  // Name is the addressing key for routes, TC_ACCT and the CLI, while identity
+  // is provider-aware — so the same email on two providers is two accounts with
+  // one name, and every name lookup becomes ambiguous. Said once at startup and
+  // again after a reload, never fatal.
+  for (const line of duplicateNameWarnings(accounts)) console.error(line);
+  // Same shape, same reason: route membership is by name while eligibility is by
+  // provider, so a route can list only accounts that cannot serve the request
+  // that arrives — and every readout still shows it healthy.
+  for (const line of routeReachabilityWarnings(config.routes, accounts)) console.error(line);
   const accountManager = new AccountManager(accounts, threshold, { routes: config.routes, ramp: config.stormRamp, distributeSessions: config.distributeSessions, projection: config.projection, expiryRouting: config.expiryRouting, adaptive });
   // Names the activity log's session column from Claude Code's own on-disk
   // session titles. Built whether or not the TUI runs, so a reload has one
@@ -392,6 +401,7 @@ async function serverCommand() {
     const diskConfig = await loadConfig();
     if (!diskConfig) return 0;
     const added = await syncAccountsFromDisk(diskConfig, config, accountManager);
+    for (const line of duplicateNameWarnings(accountManager.accounts)) console.error(line);
     // Pick up client-key edits (proxy.clientKeys is read live by both auth
     // gates through the shared config object, so refreshing it here is all a
     // key add/rotate/revoke needs — no restart).
@@ -408,6 +418,9 @@ async function serverCommand() {
     // Pick up route table edits (teamclaude route …, TUI editor, or a hand edit).
     config.routes = diskConfig.routes || [];
     accountManager.setRoutes(config.routes);
+    // After setRoutes, not before: a route edit is the whole reason this check
+    // exists, and reading the table it replaced would miss exactly that.
+    for (const line of routeReachabilityWarnings(config.routes, accountManager.accounts)) console.error(line);
     // Pick up a distributeSessions change (hand edit or another writer) the same
     // way routes, sx, probe and warmup are picked up below.
     // Not coerced to a boolean: 'adaptive' is a third mode, and !! would flatten
@@ -497,6 +510,9 @@ async function serverCommand() {
         if (config.routes != null) diskConfig.routes = config.routes;
       }),
       syncAccounts: reloadAccounts,
+      // Read through to the live supervisor rather than snapshotting: it
+      // respawns on its own schedule and the TUI redraws on a timer.
+      getSidecars: () => sidecar?.getStatus() || [],
       // `p` key: on-demand fleet-wide quota refresh. The prober is constructed
       // after the TUI, so this is a thunk over the closure variable.
       probeQuota: () => prober?.probeAll(),
@@ -804,8 +820,21 @@ async function loginCodexCommand() {
   // account would fail on its next restart. So the upsert runs against a fresh
   // read of the file, and only this account's row is touched.
   await atomicConfigUpdate(config => {
-    const name = argValue('--name') || creds.email
+    // A Codex login is named for its email, and the same person's Anthropic
+    // account is named for the same email — so the default collides by default.
+    // Name is the addressing key (routes, TC_ACCT, `disable`), and a route
+    // listing an ambiguous name admits BOTH accounts, including the one that
+    // cannot serve the request. Prefix rather than refuse: the operator asked
+    // for this login, and a name they did not choose is a smaller surprise than
+    // a failed command. An explicit --name is theirs and is left alone.
+    const preferred = creds.email
       || `codex-${config.accounts.filter(a => a.provider === 'codex').length + 1}`;
+    const takenByOther = (n) => config.accounts.some(a => a.name === n && a.provider !== 'codex');
+    const name = argValue('--name')
+      || (takenByOther(preferred) ? `codex:${preferred}` : preferred);
+    if (!argValue('--name') && name !== preferred) {
+      console.log(`Named "${name}" — "${preferred}" is already an account on another provider.`);
+    }
 
     const account = {
       name,

package/src/provider.js

@@ -24,6 +24,11 @@ export const PROVIDERS = {
     // Anthropic pins the account inside the request body (metadata.user_id),
     // so the body rewrites apply here and only here.
     rewritesBody: true,
+    // Claude Code waits for the first response byte for as long as its own
+    // API_TIMEOUT_MS allows, which is generous. That is what lets the proxy
+    // wait out a short retry-after, or poll for an account to recover, without
+    // the client ever seeing the 429.
+    holdsConnection: true,
   },
   codex: {
     id: 'codex',
@@ -36,6 +41,13 @@ export const PROVIDERS = {
     // needed — and the Anthropic-specific tool-pair repair would be wrong to
     // apply to a Responses API body.
     rewritesBody: false,
+    // A Codex client gives the response head a fixed 60s and then retries the
+    // whole request, about four times, before failing. None of that is visible
+    // from here, so a wait we intended as "absorb this for the client" reads to
+    // it as a hang: it abandons the attempt we are still holding, retries into
+    // the same wait, and turns one reportable 429 into a ~250s silent stall and
+    // then a storm of them. Answer it instead and let it back off knowing why.
+    holdsConnection: false,
   },
 };
 
@@ -169,6 +181,12 @@ export function applyAuthHeaders(headers, account) {
   const provider = providerOf(account);
   if (provider === 'codex') {
     headers['authorization'] = `Bearer ${account.credential}`;
+    // Cleared before it is set, not merely overwritten. `authorization` is
+    // stripped from every inbound request, but this header is not — so a
+    // caller that sends one of its own (a translating sidecar does, from its
+    // own local login) would have it survive for an account that carries no
+    // accountId, pairing THIS account's token with THAT caller's account id.
+    delete headers['chatgpt-account-id'];
     if (account.accountId) headers['chatgpt-account-id'] = account.accountId;
     return;
   }
@@ -195,6 +213,25 @@ export function upstreamFor(account, configuredUpstream) {
   return configuredUpstream || PROVIDERS.anthropic.upstream;
 }
 
+/**
+ * Whether the proxy may hold a request on the connection — waiting out a
+ * retry-after, or polling for an account to recover — instead of answering now.
+ *
+ * Holding is only invisible to a client that waits longer than we do. That is a
+ * property of the client, and the request path is what we know about it: every
+ * caller on the Codex path speaks the Codex protocol and brings its own fixed
+ * deadline with it, whether it is the Codex CLI or a translating sidecar's back
+ * leg. Keyed on the provider rather than on the caller's address, because a
+ * loopback peer does not narrow it — Claude Code is loopback too.
+ *
+ * Only the WAIT is withheld. Pausing the account, so concurrent requests avoid
+ * it, still happens; the client is simply told now, with the retry-after it
+ * needs to act on.
+ */
+export function holdsConnection(provider) {
+  return PROVIDERS[provider && PROVIDERS[provider] ? provider : DEFAULT_PROVIDER].holdsConnection;
+}
+
 /** Whether the Anthropic-only body rewrites apply to this account. */
 export function rewritesBody(account) {
   return PROVIDERS[providerOf(account)].rewritesBody;

package/src/route-warnings.js

@@ -0,0 +1,60 @@
+// Config coherence a route cannot check for itself.
+//
+// Route membership is by NAME, but eligibility is by PROVIDER — and the two
+// disagree silently. A route may name three accounts, every one of them healthy
+// in `teamclaude status`, and still be unable to answer the request that
+// actually arrives, because the arriving path decides which of them are even
+// candidates.
+
+import { providerOf, isSubscriptionAccount, DEFAULT_PROVIDER } from './provider.js';
+
+/**
+ * Whether `account` is a candidate for a request on `provider`'s path.
+ *
+ * Mirrors the partition selection applies (`_excludeOtherProviders`): only
+ * SUBSCRIPTION accounts are fenced off by provider, because a Claude Max token
+ * is issued to Claude and a ChatGPT token to Codex. An API key is metered
+ * capacity rather than a seat, so it stays eligible for whichever app is asking.
+ */
+export function canServeProvider(account, provider) {
+  return providerOf(account) === provider || !isSubscriptionAccount(account);
+}
+
+/**
+ * Warn about a route that no inbound Claude Code request can be served by.
+ *
+ * The failure this exists for, observed live on 2026-09-15: a `gpt-*` route lost
+ * the one account that served its inbound leg — the local translating sidecar —
+ * leaving only the ChatGPT subscriptions its back leg draws on. Those are Codex
+ * accounts, so they serve `/backend-api/codex/*` and nothing else. Every GPT
+ * request died instantly while `teamclaude status` showed two healthy accounts
+ * sitting on the route, and nothing anywhere said why.
+ *
+ * Only routes with an explicit `accounts` list are checked. An empty list means
+ * "the whole fleet", which cannot have this problem — and the explicit list is
+ * where the trap lives, because it is edited by hand and silently load-bearing.
+ */
+export function routeReachabilityWarnings(routes = [], accounts = []) {
+  const warnings = [];
+  for (const route of routes || []) {
+    const listed = route?.accounts;
+    if (!Array.isArray(listed) || listed.length === 0) continue;
+    const members = (accounts || []).filter(a =>
+      listed.includes(a?.name) || (a?.index != null && listed.includes(String(a.index))));
+    // No member resolves at all: a different fault (a name that names nothing),
+    // and reporting it as "cannot serve" would point at the wrong repair.
+    if (members.length === 0) continue;
+    if (members.some(a => canServeProvider(a, DEFAULT_PROVIDER))) continue;
+
+    const names = members.map(a => a.name).join(', ');
+    const providers = [...new Set(members.map(a => providerOf(a)))].join('/');
+    const globs = (route.match || []).join(', ');
+    warnings.push(
+      `[TeamClaude] Route "${route.name}"${globs ? ` (${globs})` : ''} has no account that can serve `
+      + `/v1/messages — every account it lists (${names}) is a ${providers} subscription, which serves `
+      + 'only its own path. Claude Code requests matching this route will find no account, while '
+      + '`teamclaude status` shows the route healthy. Add back the account that serves the inbound '
+      + 'leg (for a sidecar setup, the local one).');
+  }
+  return warnings;
+}

package/src/server.js

@@ -12,7 +12,7 @@ import { parseRequestModel, parseAdvisorModel } from './account-manager.js';
 import { TopLevelFieldFinder, modelGlobMatches } from './model.js';
 import { BodyWriter, truncationNote } from './request-log.js';
 import { upstreamFetch, upstreamPoolStatus } from './upstream-fetch.js';
-import { applyAuthHeaders, upstreamFor, rewritesBody, providerForPath, providerOf, isSubscriptionAccount, DEFAULT_PROVIDER } from './provider.js';
+import { applyAuthHeaders, upstreamFor, rewritesBody, providerForPath, providerOf, isSubscriptionAccount, holdsConnection, DEFAULT_PROVIDER } from './provider.js';
 import { tunnelTls } from './sx.js';
 import { createEgressGuard } from './egress-guard.js';
 import { safeLine } from './safe-text.js';
@@ -801,13 +801,15 @@ const SESSION_ID_SHAPE = /^[A-Za-z0-9._-]{1,128}$/;
 /** The session id a request carries, or null when the header is absent or
  *  malformed — a malformed one is treated as no session, not rejected.
  *
- *  Claude Code sends `x-claude-code-session-id`, the Codex CLI `session-id`.
- *  Reading only the first left every Codex request untagged, so
- *  `distributeSessions` had nothing to place and a Codex pool stayed on one
- *  account until the switch threshold. The specific header wins when both are
- *  present: `session-id` is generic enough for a proxy in front to set. */
+ *  Claude Code sends `x-claude-code-session-id`, the Codex CLI `session-id`,
+ *  and a translating sidecar re-emits the session it was given as `session_id`
+ *  (the spelling the Codex backend itself uses). Reading only the first left
+ *  every Codex request untagged, so `distributeSessions` had nothing to place
+ *  and a Codex pool stayed on one account until the switch threshold. Order is
+ *  most-specific first: the underscore form is the one a sidecar writes on our
+ *  behalf, and `session-id` is generic enough for a proxy in front to set. */
 export function clientSessionId(headers) {
-  const raw = headers['x-claude-code-session-id'] ?? headers['session-id'];
+  const raw = headers['x-claude-code-session-id'] ?? headers['session-id'] ?? headers['session_id'];
   return typeof raw === 'string' && SESSION_ID_SHAPE.test(raw) ? raw : null;
 }
 
@@ -2072,7 +2074,11 @@ export async function forwardRequest(req, res, body, accountManager, upstream, r
     // recovers or the budget (holdSeconds) runs out. Claude Code waits for
     // the first response byte, so this is transparent to the client as long
     // as API_TIMEOUT_MS on the Claude Code side is large enough.
-    if (ctx.holdBudgetMs > 0) {
+    //
+    // Which is exactly the assumption `holdsConnection` exists to check. A
+    // Codex caller gives up on the head long before the budget does, so for it
+    // the hold is not transparent at all — it is the whole failure.
+    if (ctx.holdBudgetMs > 0 && holdsConnection(ctx.provider)) {
       // Cap the per-poll sleep to 60s so a newly-available account (e.g. one
       // manually enabled or whose quota reset early) is picked up within a
       // minute instead of sleeping the full retryAfter (often 3600s).
@@ -2085,7 +2091,7 @@ export async function forwardRequest(req, res, body, accountManager, upstream, r
     }
 
     const exhaustedRetries = ctx.exhaustedRetries || 0;
-    if (exhaustedRetries < 1 && retryAfter <= INLINE_RETRY_AFTER_MAX_SECONDS) {
+    if (exhaustedRetries < 1 && retryAfter <= INLINE_RETRY_AFTER_MAX_SECONDS && holdsConnection(ctx.provider)) {
       ctx.exhaustedRetries = exhaustedRetries + 1;
       console.log(`[TeamClaude] All accounts exhausted — waiting ${retryAfter}s before retry`);
       await waitForRetry(retryAfter * 1000, ctx.signal);
@@ -2413,17 +2419,19 @@ export async function forwardRequest(req, res, body, accountManager, upstream, r
       // Absorb short waits inline on the same account — the client never sees the
       // 429. Bounded by retryCount (maxRetries = account count) so a persistently
       // rate-limited account can't loop forever tying up the connection.
-      if (retryAfter <= RATE_LIMIT_ABSORB_MAX_SECONDS && retryCount < maxRetries) {
+      if (retryAfter <= RATE_LIMIT_ABSORB_MAX_SECONDS && retryCount < maxRetries && holdsConnection(ctx.provider)) {
         console.log(`[TeamClaude] Rate-limit 429 on "${account.name}" — waiting ${retryAfter}s, retrying same account (no switch)`);
         await waitForRetry(retryAfter * 1000, ctx.signal);
         if (clientGone(res)) { ctx.abandoned = true; return; }
         return forwardRequest(req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir, sx, nextUseSx);
       }
 
-      // Longer retry-after (or retries exhausted): don't hold the connection and
-      // don't rotate — surface the 429 with retry-after so the client backs off.
-      // The pause above keeps other requests off this account meanwhile.
-      console.log(`[TeamClaude] Rate-limit 429 on "${account.name}" — retry-after ${retryAfter}s over inline cap; returning 429 to client (no switch)`);
+      // Longer retry-after, retries exhausted, or a caller that will not wait
+      // for us (see holdsConnection): don't hold the connection and don't
+      // rotate — surface the 429 with retry-after so the client backs off. The
+      // pause above keeps other requests off this account meanwhile.
+      const why = holdsConnection(ctx.provider) ? `retry-after ${retryAfter}s over inline cap` : `${ctx.provider} caller does not wait`;
+      console.log(`[TeamClaude] Rate-limit 429 on "${account.name}" — ${why}; returning 429 to client (no switch)`);
       ctx.status = 429;
       if (!res.headersSent && !clientGone(res)) {
         res.writeHead(429, { 'Content-Type': 'application/json', 'retry-after': String(retryAfter) });

package/src/status-renderer.js

@@ -211,10 +211,25 @@ function routingLines(routes, blocked, paint) {
     // say so, rather than listing eligible accounts it will never reach.
     const routeBlocked = globs.length > 0
       && globs.every(g => blocked.some(p => modelGlobOverlaps(p, g)));
+    // A route may list accounts from two providers — a local translating sidecar
+    // on this route's own wire, plus the subscription pool its back leg reaches.
+    // Tag the ones that are not this route's own provider, so a mixed row says
+    // which hop each account serves instead of reading as one flat pool.
+    const routeProvider = route.provider || 'anthropic';
+    const accountText = (a) => {
+      const foreign = a.provider && a.provider !== routeProvider;
+      // Unless the name already leads with it. `login --codex` mints
+      // `codex:someone@example.com`, so tagging that again reads
+      // `codex:someone@example.com:codex` — the same word twice, once as the
+      // thing's name and once as a fact about it.
+      const saysSoItself = foreign && a.name.startsWith(`${a.provider}:`);
+      const tag = foreign && !saysSoItself ? `:${nameText(a.provider)}` : '';
+      return nameText(a.name) + tag;
+    };
     const accounts = routeBlocked
       ? paint.red('blocked')
       : (route.accounts || [])
-        .map(a => (a.eligible ? paint.green(nameText(a.name)) : paint.red(nameText(a.name)))).join(' ') || paint.gray('(none)');
+        .map(a => (a.eligible ? paint.green(accountText(a)) : paint.red(accountText(a)))).join(' ') || paint.gray('(none)');
     const tag = route.autocreated ? paint.dim(' (auto)') : route.bucket ? paint.dim(` [${nameText(route.bucket)}]`) : '';
     const pin = route.pinned ? paint.dim(` [pinned: ${nameText(route.pinned)}]`) : '';
     // padEnd on the raw text, color after, so ANSI codes don't throw off alignment.

package/src/tui-remote.js

@@ -264,7 +264,21 @@ export class RemoteAccountManager {
       target: r?.target == null ? r?.target : text(r.target, NAME_MAX),
       match: (Array.isArray(r?.match) ? r.match : []).map(g => text(g, 64)).filter(Boolean),
       accounts: (Array.isArray(r?.accounts) ? r.accounts : [])
-        .map(a => ({ ...a, name: text(a?.name, NAME_MAX, '?'), eligible: !!a?.eligible })),
+        .map(a => ({
+          ...a,
+          name: text(a?.name, NAME_MAX, '?'),
+          provider: a?.provider == null ? a?.provider : text(a.provider, 16),
+          eligible: !!a?.eligible,
+        })),
+    }));
+    // Conduit lines read this. Clamped like every other remote field: the
+    // payload is a server's word, not ours, and it reaches a rendered line.
+    this.sidecars = (Array.isArray(status?.sidecars) ? status.sidecars : []).map(sc => ({
+      name: text(sc?.name, NAME_MAX, '?'),
+      running: !!sc?.running,
+      pid: Number.isFinite(sc?.pid) ? sc.pid : null,
+      restarts: Number.isFinite(sc?.restarts) ? sc.restarts : 0,
+      lastExit: sc?.lastExit == null ? null : text(sc.lastExit, 48),
     }));
     this.status = status;
     this.connected = true;

package/src/tui.js

@@ -405,6 +405,9 @@ function timestamp() {
 
 export class TUI {
   constructor({ accountManager, config, saveConfig, syncAccounts, onQuit, sx = null, probeQuota = null, activityLogPath = null,
+    // Supervised sidecar state for the conduit lines. A getter, not a snapshot:
+    // the supervisor respawns on its own schedule and the TUI redraws on a timer.
+    getSidecars = null,
     // Attach mode: the accounts belong to a server in another process, reached
     // over its control plane. Everything that would mutate local state is off,
     // and a switch becomes a request (applySwitch) instead of an assignment.
@@ -429,6 +432,7 @@ export class TUI {
     this.sx = sx;            // sx.org proxy manager (may be null)
     this.sxBalance = null;   // last fetched sx.org balance, for the settings screen
     this.probeQuota = probeQuota; // on-demand fleet-wide quota refresh (may be null)
+    this.getSidecars = getSidecars; // supervised sidecar state (may be null)
     this.activityLogPath = activityLogPath;
     this._readCredentials = readCredentials;
     this._readProfile = readProfile;
@@ -1519,6 +1523,8 @@ export class TUI {
         const b = budgets.get(categoryOf(this.am.accounts[i]));
         lines.push(this._renderAcct(i, b.bw, b.showBoth, routes, genRoutes, familyTarget, b.showFamily, nameW));
       }
+      // Local backends sit under the seats, as a readout rather than rows.
+      lines.push(...this._conduitLines());
     }
 
     // Routing is surfaced inline on each account row (see _renderAcct): a colored
@@ -1570,14 +1576,15 @@ export class TUI {
     this._paint(buf, force);
   }
 
-  /** Manager indices in the order the rows are drawn: accounts served by a
-   *  local process last, every other account left where it is.
+  /** Manager indices of the accounts drawn as rows: the seats that rotate.
    *
-   *  A local backend (a translating proxy in front of another vendor, say) is
-   *  infrastructure rather than a seat to rotate between, so it reads as noise
-   *  wedged among the accounts that do rotate. Config order cannot keep it out
-   *  of the way on its own, because a newly added account is appended AFTER it
-   *  and puts it back in the middle.
+   *  A local backend — a translating proxy in front of another vendor — is
+   *  infrastructure, not a seat. It holds no subscription (its token is a
+   *  placeholder), it is the only candidate its route has, so it never rotates,
+   *  and it has no quota of its own to show. Drawn among the accounts it was a
+   *  row of dashes and borrowed numbers in a table whose whole purpose is which
+   *  account is being spent. It gets its own line below instead — see
+   *  _conduitLines. Sorting it last was the first half of this thought.
    *
    *  Display only. `selIdx`, `currentIndex`, session pins and route entries all
    *  stay manager indices, so nothing about selection or routing moves with the
@@ -1586,11 +1593,44 @@ export class TUI {
   _displayOrder() {
     return this.am.accounts
       .map((_, i) => i)
-      .sort((x, y) => {
-        const sx = isLocalUpstream(this.am.accounts[x]) ? 1 : 0;
-        const sy = isLocalUpstream(this.am.accounts[y]) ? 1 : 0;
-        return sx - sy || x - y; // ties keep list order, so the sort is stable
-      });
+      .filter(i => !isLocalUpstream(this.am.accounts[i]));
+  }
+
+  /** Manager indices of the local backends, in config order. */
+  _conduitOrder() {
+    return this.am.accounts.map((_, i) => i).filter(i => isLocalUpstream(this.am.accounts[i]));
+  }
+
+  /** One line per local backend: what it is, where it sends, and whether it can
+   *  serve. Its supervised process's state is folded in when this TUI has it
+   *  (the server passes a getter; the remote TUI reads the status payload), so
+   *  a crash-looping sidecar says so here rather than only in `status --json`.
+   *
+   *  Deliberately terse. There is nothing to choose between, so this is a
+   *  readout, not a row: the operator needs "is it up" and nothing else. */
+  _conduitLines() {
+    const sidecars = this._sidecars();
+    return this._conduitOrder().map(i => {
+      const a = this.am.accounts[i];
+      let host = a.upstream;
+      try { host = new URL(a.upstream).host; } catch { /* keep the raw string */ }
+      // Matched by name: a sidecars[] entry and the account that routes to it
+      // are named by the same operator, and nothing else pairs them.
+      const proc = sidecars.find(sc => sc.name === a.name) || null;
+      const state = a.disabled ? red('disabled')
+        : a.rateLimitedUntil > Date.now() ? yellow('throttled')
+          : proc && !proc.running ? red(`down (${proc.lastExit || 'restarting'})`)
+            : proc ? green('up') : green('ok');
+      const pid = proc?.running ? dim(` pid ${proc.pid}`) : '';
+      const restarts = proc?.restarts ? yellow(` ${proc.restarts} restarts`) : '';
+      return ` ${dim('⚙')} ${a.name} ${dim('→')} ${dim(host)}  ${state}${pid}${restarts}`;
+    });
+  }
+
+  /** Supervised sidecar state, or [] when this TUI has no view of it. */
+  _sidecars() {
+    const list = this.getSidecars ? this.getSidecars() : this.am.sidecars;
+    return Array.isArray(list) ? list : [];
   }
 
   _renderAcct(idx, bw, showBoth, routes = this.am.getRoutes(), genRoutes = routes.filter(r => routeFamily(r) === null), familyTarget = {}, showFamily = true, nameW = NAME_MIN) {