cdx-manager 0.21.5 → 0.22.0

package/src/run_usage.py

@@ -14,6 +14,11 @@ The definitions below are therefore normative, not a suggestion:
                         natively; Codex does not, so its cache-inclusive count
                         is reduced here rather than left for a reader to guess.
   cache_creation_tokens Tokens written to the provider's prompt cache.
+  cache_creation_1h_tokens
+                        The part of cache_creation_tokens written with
+                        Anthropic's one-hour TTL, which costs 2x instead of
+                        1.25x. A subset, never added to a total; absent when
+                        the provider does not report the split.
   cache_read_tokens     Tokens served from it.
   cached_input_tokens   cache_creation + cache_read. Kept because it is a
                         published field of `cdx run --json`, and because the
@@ -31,8 +36,8 @@ The definitions below are therefore normative, not a suggestion:
                         quantity.
 
 Cache creation and cache read are separate fields because they cost very
-differently -- 1.25x and 0.1x of uncached input -- and a weighted figure cannot
-recover the split once they are summed.
+differently -- 1.25x (2x for a one-hour TTL) and 0.1x of uncached input -- and
+a weighted figure cannot recover the split once they are summed.
 
 Absence stays absent: `None` means "not reported", which is not zero. Only
 `normalize_usage` may derive `cached_input_tokens` and `total_tokens`, so no
@@ -49,6 +54,7 @@ USAGE_KEYS = (
     "input_tokens",
     "cached_input_tokens",
     "cache_creation_tokens",
+    "cache_creation_1h_tokens",
     "cache_read_tokens",
     "output_tokens",
     "reasoning_tokens",
@@ -64,7 +70,7 @@ def empty_usage():
 
 
 def normalize_usage(input_tokens=None, cache_creation_tokens=None, cache_read_tokens=None,
-                    output_tokens=None, reasoning_tokens=None):
+                    output_tokens=None, reasoning_tokens=None, cache_creation_1h_tokens=None):
     """Build a usage record from the four measured quantities.
 
     The derived fields are computed here and only here. A record whose parts are
@@ -80,6 +86,11 @@ def normalize_usage(input_tokens=None, cache_creation_tokens=None, cache_read_to
     }
     if all(value is None for value in parts.values()):
         return empty_usage()
+    long_ttl = _non_negative(cache_creation_1h_tokens)
+    if long_ttl is not None:
+        # A subset of the writes; more than the writes is not a subset.
+        long_ttl = min(long_ttl, parts["cache_creation_tokens"] or 0)
+    parts["cache_creation_1h_tokens"] = long_ttl
     cached = _sum_present(parts["cache_creation_tokens"], parts["cache_read_tokens"])
     total = _sum_present(
         parts["input_tokens"],
@@ -94,12 +105,13 @@ def normalize_usage(input_tokens=None, cache_creation_tokens=None, cache_read_to
 #:
 #: Defaults for rows without an explicit cache-read price. Newer models can
 #: discount reads further; both stats and currency use the table's rate.
-#: Anthropic's one-hour cache TTL costs 2x instead; nothing in a transcript
-#: says which TTL was used, so long-TTL writes are under-weighted. Cache writes
-#: are a small share of a cache-heavy session, so that error is bounded --
-#: stated here rather than hidden behind a single averaged number.
+#: Anthropic's one-hour cache TTL costs 2x instead. Claude transcripts report
+#: that split as `cache_creation.ephemeral_1h_input_tokens`; Claude Code writes
+#: most of its cache that way, so pricing every write at 1.25x understated
+#: them by up to 1.6x. A record without the split keeps the 1.25x rate.
 CACHE_READ_MULTIPLIER = 0.1
 CACHE_WRITE_MULTIPLIER = 1.25
+CACHE_WRITE_1H_MULTIPLIER = 2.0
 
 #: What an output token costs relative to an uncached input one, when the model
 #: is unknown. Current model ratios vary, so an unknown model is priced at the
@@ -144,7 +156,8 @@ def weighted_usage(usage, model=None, prices=None):
     That is not the ranking anyone reading `cdx stats` is looking for.
 
     Output and cache-read ratios come from the model that served the run.
-    Cache writes retain the five-minute TTL assumption.
+    Cache writes use the one-hour rate for the part the provider reported as
+    one-hour, the five-minute rate for the rest.
 
     `reasoning_tokens` is deliberately excluded: Codex reports it as a subset
     of its output, and counting it would bill those tokens twice.
@@ -154,12 +167,13 @@ def weighted_usage(usage, model=None, prices=None):
     weights = {
         "input_tokens": 1.0,
         "cache_creation_tokens": CACHE_WRITE_MULTIPLIER,
+        "cache_creation_1h_tokens": CACHE_WRITE_1H_MULTIPLIER - CACHE_WRITE_MULTIPLIER,
         "cache_read_tokens": cache_read_multiplier(model, prices),
         "output_tokens": output_multiplier(model, prices),
     }
     present = []
     for key, weight in weights.items():
-        value = usage.get(key)
+        value = _long_ttl_writes(usage) if key == "cache_creation_1h_tokens" else usage.get(key)
         if value is not None:
             if weight is None and value:
                 return None
@@ -297,9 +311,20 @@ def estimate_cost(usage, model, prices=None):
     ]
     if not present:
         return None
+    long_ttl = _long_ttl_writes(usage) or 0
+    present.append(rate["input"] * (CACHE_WRITE_1H_MULTIPLIER - CACHE_WRITE_MULTIPLIER) * long_ttl)
     return sum(present) / 1_000_000
 
 
+def _long_ttl_writes(usage):
+    """One-hour cache writes, bounded by the writes they are a part of."""
+    long_ttl = usage.get("cache_creation_1h_tokens")
+    if not isinstance(long_ttl, (int, float)) or isinstance(long_ttl, bool) or long_ttl <= 0:
+        return None
+    writes = usage.get("cache_creation_tokens")
+    return min(long_ttl, writes) if isinstance(writes, (int, float)) and not isinstance(writes, bool) else None
+
+
 def claude_usage_dedup_key(record):
     """What identifies one *billed* Claude API response in a transcript.
 
@@ -362,6 +387,7 @@ def coerce_usage(usage):
         cache_read_tokens=usage.get("cache_read_tokens"),
         output_tokens=usage.get("output_tokens"),
         reasoning_tokens=usage.get("reasoning_tokens"),
+        cache_creation_1h_tokens=usage.get("cache_creation_1h_tokens"),
     )
     if record["cached_input_tokens"] is None:
         # A legacy record carrying only the fused figure: keep it visible rather
@@ -493,6 +519,7 @@ def _usage_from_dict(value):
     return normalize_usage(
         input_tokens=input_tokens,
         cache_creation_tokens=cache_creation,
+        cache_creation_1h_tokens=_nested_int(usage, "cache_creation", "ephemeral_1h_input_tokens"),
         cache_read_tokens=cache_read,
         output_tokens=_int_value(usage.get("output_tokens"), usage.get("completion_tokens")),
         reasoning_tokens=_int_value(

package/src/session_backup.py

@@ -106,13 +106,16 @@ def _collect_auth_files(session_root, provider, session_name=None, progress_call
             })
     return {"files": files, "file_count": len(files), "bytes": total_bytes}
 
-def _validate_import_profile_files(payload, imported_sessions):
+def _validate_import_profile_files(payload, imported_sessions, include_auth=True):
     profiles = payload.get("profiles") or {}
     if not isinstance(profiles, dict):
         raise CdxError("Bundle contains invalid profile data.")
+    if any(profiles.values()) and not include_auth:
+        raise CdxError("Bundle contains profile files but no auth payload.")
     decoded_profiles = {}
     for session_payload in imported_sessions:
         name = session_payload["name"]
+        allowed_paths = _auth_bundle_paths(_normalize_provider(session_payload["provider"]))
         files = []
         profile_items = profiles.get(name, [])
         if not isinstance(profile_items, list):
@@ -121,6 +124,8 @@ def _validate_import_profile_files(payload, imported_sessions):
             if not isinstance(item, dict):
                 raise CdxError(f"Bundle contains invalid profile entry for session {name}.")
             rel_path = _safe_relpath(item.get("path"))
+            if rel_path not in allowed_paths:
+                raise CdxError(f"Bundle contains an unexpected file for session {name}: {rel_path}")
             data_b64 = item.get("data_b64")
             if not isinstance(data_b64, str):
                 raise CdxError(f"Bundle contains invalid file data for session {name}: {rel_path}")
@@ -288,9 +293,14 @@ def import_bundle(base_dir, store, file_path,
         )
 
     for session_payload in imported_sessions:
-        _validate_new_session_name(session_payload["name"])
+        if session_payload["name"] not in existing:
+            _validate_new_session_name(session_payload["name"])
         _normalize_provider(session_payload["provider"])
-    decoded_profiles = _validate_import_profile_files(payload, imported_sessions)
+        # A rollback removes the profile folder, so never adopt one we did not create.
+        if session_payload["name"] not in existing and os.path.lexists(_get_session_root(base_dir, session_payload["name"])):
+            raise CdxError(f"Session profile already exists: {session_payload['name']}")
+    decoded_profiles = _validate_import_profile_files(payload, imported_sessions,
+                                                      include_auth=bool(decoded["meta"].get("include_auth")))
 
     for session_payload in imported_sessions:
         name = session_payload["name"]
@@ -318,7 +328,8 @@ def import_bundle(base_dir, store, file_path,
             bundle_carries_credential = provider == PROVIDER_CLAUDE and any(
                 item["path"] == CLAUDE_CREDENTIALS_BUNDLE_PATH for item in decoded_profiles.get(name, [])
             )
-            if bundle_carries_credential:
+            # Force replaces the login even when the bundle has none to offer.
+            if bundle_carries_credential or (force and provider == PROVIDER_CLAUDE):
                 local_credential = read_keychain_credentials(old_record["authHome"])
             recovery_dir = tempfile.mkdtemp(prefix=f".{_encode(name)}.import.", dir=os.path.dirname(session_root))
             backup_root = os.path.join(recovery_dir, "profile")
@@ -405,7 +416,7 @@ def import_bundle(base_dir, store, file_path,
                 # Decrypted credentials: 0o600 from creation, no umask window.
                 atomic_write(dest_path, item["content"], mode=0o600)
                 imported_paths.append(item["path"])
-            if provider == PROVIDER_CLAUDE and CLAUDE_CREDENTIALS_BUNDLE_PATH in imported_paths:
+            if provider == PROVIDER_CLAUDE and (force and old_record or CLAUDE_CREDENTIALS_BUNDLE_PATH in imported_paths):
                 delete_keychain_credentials(auth_home)
             _restore_force_import_profile_paths(name, backup_root, session_root, preserved_profile_paths)
         except Exception:

package/src/session_helpers.py

@@ -8,6 +8,7 @@ them there keep working.
 """
 
 import os
+import re
 import sys
 from datetime import datetime
 from urllib.parse import quote
@@ -150,6 +151,9 @@ def _validate_new_session_name(name):
         raise CdxError(f"Session name is too long (max {MAX_SESSION_NAME_LENGTH} characters)")
     if any(ord(ch) < 32 or ord(ch) == 127 for ch in str(name)):
         raise CdxError("Session name cannot contain control characters")
+    # Tray launchers and shell hints pass the name to a shell: keep it inert.
+    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]*", str(name)):
+        raise CdxError("Session name may only contain letters, digits, '.', '_' and '-', and must start with a letter or digit")
     if name in RESERVED_SESSION_NAMES:
         raise CdxError(f"Session name is reserved: {name}")
 

package/src/session_ranking.py

@@ -71,6 +71,8 @@ def reasoning_rank(value):
 
 
 def _is_usable_now(row):
+    if row.get("rate_limit_reached"):
+        return False
     available = row.get("available_pct")
     return available is not None and available > USABLE_AVAILABLE_THRESHOLD
 
@@ -164,6 +166,10 @@ def candidate_rows(rows, provider=None, require_ready=False, min_reasoning_effor
     for row in rows:
         if row.get("enabled", True) is False:
             continue
+        if row.get("policy") in ("ask-first", "never"):
+            # Never picked on the user's behalf: `ask-first` is still offered
+            # where a person confirms (cdx rescue), `never` is not offered at all.
+            continue
         if provider is not None and row.get("provider") != provider:
             continue
         if _row_is_logged_out(row):
@@ -199,6 +205,10 @@ def _row_is_ready(row):
 
 
 def _row_has_availability(row):
+    if row.get("rate_limit_reached"):
+        # The provider says this account cannot serve a task, whatever the
+        # percentage windows read.
+        return False
     available = row.get("available_pct")
     if available is None:
         # Unknown is not the same as empty. Excluding it here would make a

package/src/session_service.py

@@ -26,7 +26,6 @@ the re-exports as unused and callers importing through this module break.
 `test_session_service_facade_still_exposes_every_name_its_callers_import`
 guards that.
 """
-import json
 import os
 import shutil
 import tempfile
@@ -49,8 +48,11 @@ from .config import (
     normalize_permission,
     split_extra_args,
 )
+from .config import (
+    parse_on_off as _parse_on_off,
+)
 from .errors import CdxError
-from .fs_utils import atomic_write, remove_tree
+from .fs_utils import remove_tree
 from .session_backup import (  # noqa: F401  (re-exported for callers and tests)
     _FORCE_IMPORT_PRESERVED_PROFILE_PATHS,
     _auth_bundle_paths,
@@ -128,6 +130,7 @@ LAUNCH_REASONING_EFFORT_VALUES = REASONING_EFFORT_VALUES
 LAUNCH_PERMISSION_VALUES = PERMISSION_VALUES
 MAX_LAUNCH_MODEL_LENGTH = 128
 MIN_LAUNCH_PRIORITY = 0
+ACCOUNT_POLICIES = ("use", "ask-first", "never")
 MAX_LAUNCH_PRIORITY = 100
 DEFAULT_LAUNCH_SETTINGS = {
     "power": "medium",
@@ -145,18 +148,7 @@ def _seed_codex_auth_from_global(auth_home, env=None):
     return True
 
 
-_ON_OFF_SETTINGS = {"fast": "fast", "rtk": "rtk", "logics": "logics", "notify": "notify", "notify_preview": "notify preview"}
-
-
-def _parse_on_off(value, label):
-    if isinstance(value, bool):
-        return value
-    text = str(value).strip().lower()
-    if text in ("on", "true", "1", "yes"):
-        return True
-    if text in ("off", "false", "0", "no"):
-        return False
-    raise CdxError(f"Unsupported {label} value: {value}")
+_ON_OFF_SETTINGS = {"fast": "fast", "rtk": "rtk", "logics": "logics", "notify": "notify", "notify_preview": "notify preview", "scrub_env": "scrub env", "shared_memory": "shared memory", "retro": "retro"}
 
 
 def _has_control_chars(text):
@@ -175,7 +167,7 @@ def _normalize_launch_settings(settings, mark_fast_service_tier=True):
     if "reasoning_effort" in settings and settings["reasoning_effort"] is not None:
         effort = str(settings["reasoning_effort"]).strip().lower()
         if effort not in LAUNCH_REASONING_EFFORT_VALUES:
-            raise CdxError(f"Unsupported reasoning effort: {settings['reasoning_effort']}")
+            raise CdxError(f"Unsupported reasoning effort: {settings['reasoning_effort']}", code="invalid_reasoning_effort")
         normalized["reasoning_effort"] = effort
     if "permission" in settings and settings["permission"] is not None:
         # Accepts the provider-native aliases (workspace-write, read-only,
@@ -244,6 +236,10 @@ def _normalize_launch_settings(settings, mark_fast_service_tier=True):
         if priority < MIN_LAUNCH_PRIORITY or priority > MAX_LAUNCH_PRIORITY:
             raise CdxError(f"Unsupported priority: {settings['priority']}")
         normalized["priority"] = priority
+    if "policy" in settings and settings["policy"] is not None:
+        if settings["policy"] not in ACCOUNT_POLICIES:
+            raise CdxError(f"Unsupported policy: {settings['policy']} (use|ask-first|never)")
+        normalized["policy"] = settings["policy"]
     return normalized
 
 
@@ -260,24 +256,18 @@ def _parse_status_timeout_seconds(value):
 
 
 def _ensure_claude_attribution_disabled(auth_home):
-    settings_dir = os.path.join(auth_home, ".claude")
-    settings_path = os.path.join(settings_dir, "settings.json")
-    try:
-        os.makedirs(settings_dir, exist_ok=True)
-        with open(settings_path, encoding="utf-8") as handle:
-            settings = json.load(handle)
-    except FileNotFoundError:
-        settings = {}
-    except (OSError, json.JSONDecodeError):
-        settings = {}
-    if not isinstance(settings, dict):
-        settings = {}
-    settings["includeCoAuthoredBy"] = False
-    try:
-        atomic_write(settings_path, json.dumps(settings, indent=2, sort_keys=True) + "\n", mode=0o644)
-    except OSError:
+    # Same reader/writer as the notification hooks: an unparseable file is the
+    # user's and is left alone, a symlink stays a symlink, the mode is kept.
+    from .agent_notify import _read_json, _write_json
+
+    settings_path = os.path.join(auth_home, ".claude", "settings.json")
+    settings = _read_json(settings_path)
+    if settings is None:
         return False
-    return True
+    if settings.get("includeCoAuthoredBy") is False:
+        return True
+    settings["includeCoAuthoredBy"] = False
+    return _write_json(settings_path, settings)
 
 
 def _normalize_session_label(label):
@@ -334,7 +324,7 @@ def unset_launch_settings(store, name, keys):
         raise CdxError("At least one launch setting is required.")
     allowed = {
         "power", "reasoning_effort", "reasoningEffort", "permission", "fast", "rtk", "logics", "notify", "notify_preview",
-        "model", "fallback_model", "budget", "extra_args", "priority",
+        "scrub_env", "shared_memory", "retro", "model", "fallback_model", "budget", "extra_args", "priority", "policy",
     }
     unknown = [key for key in keys if key not in allowed]
     if unknown:
@@ -641,6 +631,10 @@ def create_session(base_dir, env, store, name, provider=DEFAULT_PROVIDER):
     _validate_new_session_name(name)
     normalized_provider = _normalize_provider(provider)
     session_root = _get_session_root(base_dir, name)
+    if store["get_session"](name):
+        raise CdxError(f"Session already exists: {name}")
+    if os.path.lexists(session_root):
+        raise CdxError(f"Session profile already exists: {name}")
     auth_home = _get_session_auth_home(base_dir, name, normalized_provider)
     _ensure_private_dir(base_dir)
     _ensure_private_dir(os.path.join(base_dir, "profiles"))
@@ -868,7 +862,7 @@ def launch_session(store, name, resume=False):
     if not session:
         raise CdxError(f"Unknown session: {name}")
     if session.get("enabled", True) is False:
-        raise CdxError(f"Session is disabled: {name}")
+        raise CdxError(f"Session is disabled: {name}", code="session_disabled")
     # Reconcile the prior Claude conversation before a fresh launch replaces
     # its id. This is a single exact transcript lookup, not a global stats scan.
     backfill_interactive_usage(store, name=name, dry_run=False)
@@ -937,6 +931,16 @@ def begin_conversation(store, name):
     })
 
 
+def mark_conversation_rescued(store, name, conversation_id):
+    """Stamp the source of a rescue handoff so the same conversation is not handed off twice."""
+    def updater(s):
+        conversation = s.get("conversation") or {}
+        if conversation.get("id") != conversation_id:
+            return s
+        return {**s, "conversation": {**conversation, "rescuedAt": _local_now_iso()}}
+    return store["update_session"](name, updater)
+
+
 def get_session_root(base_dir, name):
     return _get_session_root(base_dir, name)
 
@@ -975,6 +979,7 @@ def create_session_service(options=None):
         "rename_session": partial(rename_session, base_dir, store),
         "launch_session": partial(launch_session, store),
         "begin_conversation": partial(begin_conversation, store),
+        "mark_conversation_rescued": partial(mark_conversation_rescued, store),
         "active_session_runtime": partial(_session_runtime, store),
         "start_session_runtime": partial(start_session_runtime, store),
         "finish_session_runtime": partial(finish_session_runtime, store),

package/src/session_status.py

@@ -7,7 +7,7 @@ coupling measurement supports. Moved verbatim; re-exported by session_service.
 import json
 import os
 from concurrent.futures import ThreadPoolExecutor, as_completed
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 
 from .claude_credentials import claude_auth_type, setup_token_days_left
 from .claude_usage import _decode_jwt_claims
@@ -41,6 +41,79 @@ def _to_local_iso(value):
         parsed = parsed.replace(tzinfo=timezone.utc)
     return parsed.astimezone().isoformat()
 
+_MONTHS = ("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec")
+
+
+def reset_iso(display, reference=None):
+    """`Oct 20 15:00` (local time, no year) as ISO 8601, or None.
+
+    Every status source stores resets in that display shape. The year is the
+    one that puts the reset closest to `reference` (when the status was read),
+    so a January reset read in late December lands in the next year. A reset
+    with no time of day stays a date.
+    """
+    parts = str(display or "").split()
+    if len(parts) not in (2, 3) or parts[0] not in _MONTHS or not parts[1].isdigit():
+        return None
+    try:
+        hour, minute = (int(v) for v in parts[2].split(":")) if len(parts) == 3 else (0, 0)
+        now = datetime.fromisoformat(str(reference)) if reference else datetime.now().astimezone()
+        if now.tzinfo is None:
+            now = now.astimezone()
+        month, day = _MONTHS.index(parts[0]) + 1, int(parts[1])
+        candidates = []
+        for year in (now.year - 1, now.year, now.year + 1):
+            try:
+                # Naive local time resolved by the system zone, so a reset on
+                # the other side of a DST change gets its own offset.
+                candidates.append(datetime(year, month, day, hour, minute).astimezone())
+            except (ValueError, OverflowError, OSError):
+                # Windows cannot place a time before 1970 in the local zone.
+                continue
+    except (TypeError, ValueError):
+        return None
+    if not candidates:
+        return None
+    best = min(candidates, key=lambda value: abs(value - now))
+    return best.date().isoformat() if len(parts) == 2 else best.isoformat()
+
+
+_WINDOWS = {"5h": timedelta(hours=5), "week": timedelta(days=7)}
+
+
+def runs_out_at(remaining_pct, reset_at_iso, window, read_at_iso):
+    """When the account empties at the pace it used since its window opened, or None.
+
+    The window opened `window` before its reset; what was used since then, over
+    the time elapsed at the reading, is the pace. None when that pace does not
+    empty the account before the window resets, or when a figure is missing.
+    """
+    try:
+        reset = datetime.fromisoformat(str(reset_at_iso))
+        read = datetime.fromisoformat(str(read_at_iso))
+        remaining = float(remaining_pct)
+    except (TypeError, ValueError):
+        return None
+    if reset.tzinfo is None or read.tzinfo is None or len(str(reset_at_iso)) <= 10:
+        return None
+    elapsed = (read - (reset - window)).total_seconds()
+    used = 100.0 - remaining
+    if remaining <= 0 or used <= 0 or elapsed <= 0:
+        return None
+    out = read + timedelta(seconds=remaining * elapsed / used)
+    return out.isoformat() if out < reset else None
+
+
+def _runs_out(row):
+    """The earlier of the two windows' run-out times."""
+    times = [
+        runs_out_at(row.get(f"remaining_{name}_pct"), row.get(f"reset_{name}_at_iso"), window, row.get("updated_at"))
+        for name, window in _WINDOWS.items()
+    ]
+    times = [value for value in times if value]
+    return min(times, key=datetime.fromisoformat) if times else None
+
+
 def _row_priority(session):
     launch = session.get("launch") or {}
     try:
@@ -271,7 +344,7 @@ def _status_row_from_session(store, s):
     row_status = status if enabled else None
     runtime = _session_runtime(store, s["name"])
     auth_type = claude_auth_type(s["authHome"]) if s["provider"] == PROVIDER_CLAUDE and s.get("authHome") else None
-    return {
+    row = {
         "session_name": s["name"],
         "label": s.get("label"),
         "provider": s["provider"],
@@ -281,6 +354,7 @@ def _status_row_from_session(store, s):
         # recommendation path could not see either, which is why `cdx next`
         # ignored `--priority` entirely.
         "priority": _row_priority(s),
+        "policy": (s.get("launch") or {}).get("policy") or "use",
         "reasoning_effort": _row_reasoning_effort(s),
         "active": bool(runtime) if enabled else False,
         "cwd": runtime.get("cwd") if runtime else None,
@@ -298,9 +372,18 @@ def _status_row_from_session(store, s):
         "reset_5h_at": row_status.get("reset_5h_at") if row_status else None,
         "reset_week_at": row_status.get("reset_week_at") if row_status else None,
         "reset_at": row_status.get("reset_at") if row_status else None,
+        # The provider's typed block reason (workspace_owner_credits_depleted):
+        # failover and ranking read it, since the percentages can look healthy.
+        "rate_limit_reached": row_status.get("rate_limit_reached") if row_status else None,
+        **{
+            f"{key}_iso": reset_iso(row_status.get(key), _to_local_iso(s.get("lastStatusAt"))) if row_status else None
+            for key in ("reset_5h_at", "reset_week_at", "reset_at")
+        },
         "updated_at": _to_local_iso(s.get("lastStatusAt")),
         "last_launched_at": _to_local_iso(s.get("lastLaunchedAt")),
     }
+    row["runs_out_at_iso"] = _runs_out(row)
+    return row
 
 def format_list_rows(store):
     sessions = list_sessions(store)
@@ -387,6 +470,7 @@ def _resolve_session_status(store, base_dir, env, fetch_codex_status, session,
         "reset_5h_at": artifact.get("reset_5h_at"),
         "reset_week_at": artifact.get("reset_week_at"),
         "reset_at": artifact.get("reset_at"),
+        "rate_limit_reached": artifact.get("rate_limit_reached"),
         "updated_at": artifact.get("updated_at"),
         "raw_status_text": artifact.get("raw_status_text"),
         "source_ref": artifact.get("source_ref"),

package/src/shared_memory.py

@@ -0,0 +1,102 @@
+"""One Claude auto-memory per project, shared by the profiles that opt in.
+
+Claude Code keeps its auto-memory under the profile home
+(`.claude/projects/<project>/memory`), and cdx gives every profile its own
+home, so a fact learned on one account is unknown on the next. A profile with
+`shared_memory` on gets that directory as a symlink into
+`<cdx home>/shared-memory/<project>`, which every such profile reads and
+writes.
+
+Nothing is ever deleted. A profile's existing memory is copied into the store
+and the original directory kept beside it as `memory.pre-cdx-<time>`. Two
+files with the same name and different content are a conflict: the profile
+is left as it was and the caller says which files to merge by hand. The
+`MEMORY.md` index is the one exception, since it is one line per memory: its
+lines are merged, store first.
+"""
+
+import filecmp
+import os
+import re
+import shutil
+import time
+
+INDEX_NAME = "MEMORY.md"
+#: Claude Code shortens longer project folder names with a hash cdx cannot
+#: reproduce, so those projects are left alone rather than guessed at.
+MAX_PROJECT_NAME = 200
+
+
+def claude_project_name(cwd):
+    """The folder name Claude Code files a working directory under."""
+    return re.sub(r"[^A-Za-z0-9]", "-", os.path.realpath(cwd))
+
+
+def store_dir(base_dir, project):
+    return os.path.join(base_dir, "shared-memory", project)
+
+
+def link(auth_home, base_dir, cwd, now=None):
+    """Point the profile's memory for `cwd` at the shared store.
+
+    Returns (status, detail): `linked` (done now or already), `skipped`
+    (project name too long, or the memory path is a link cdx did not make),
+    `conflict` (detail lists the files), `unsupported` (no symlinks here).
+    """
+    project = claude_project_name(cwd)
+    if len(project) > MAX_PROJECT_NAME:
+        return "skipped", "project path too long to match Claude Code's folder name"
+    store = store_dir(base_dir, project)
+    memory = os.path.join(auth_home, ".claude", "projects", project, "memory")
+    if os.path.islink(memory):
+        if os.path.realpath(memory) == os.path.realpath(store):
+            return "linked", memory
+        return "skipped", f"{memory} already links elsewhere"
+    os.makedirs(store, exist_ok=True)
+    if os.path.isdir(memory):
+        conflicts = _conflicts(memory, store)
+        if conflicts:
+            return "conflict", conflicts
+        _merge_into(memory, store)
+        stamp = time.strftime("%Y%m%dT%H%M%S", time.gmtime(time.time() if now is None else now))
+        os.rename(memory, f"{memory}.pre-cdx-{stamp}")
+    else:
+        os.makedirs(os.path.dirname(memory), exist_ok=True)
+    try:
+        os.symlink(store, memory, target_is_directory=True)
+    except (OSError, NotImplementedError) as error:
+        return "unsupported", str(error)
+    return "linked", memory
+
+
+def _conflicts(memory, store):
+    found = []
+    for name in sorted(os.listdir(memory)):
+        source, target = os.path.join(memory, name), os.path.join(store, name)
+        if not os.path.exists(target) or name == INDEX_NAME:
+            continue
+        if os.path.isdir(source) or os.path.isdir(target) or not filecmp.cmp(source, target, shallow=False):
+            found.append(name)
+    return found
+
+
+def _merge_into(memory, store):
+    for name in os.listdir(memory):
+        source, target = os.path.join(memory, name), os.path.join(store, name)
+        if name == INDEX_NAME and os.path.exists(target):
+            _merge_index(source, target)
+        elif not os.path.exists(target):
+            if os.path.isdir(source):
+                shutil.copytree(source, target)
+            else:
+                shutil.copy2(source, target)
+
+
+def _merge_index(source, target):
+    with open(target, encoding="utf-8") as handle:
+        kept = handle.read().splitlines()
+    with open(source, encoding="utf-8") as handle:
+        added = [line for line in handle.read().splitlines() if line.strip() and line not in kept]
+    if added:
+        with open(target, "w", encoding="utf-8") as handle:
+            handle.write("\n".join(kept + added) + "\n")

package/src/status_source.py

@@ -773,6 +773,8 @@ def find_latest_status_artifact(
                 "reset_5h_at": candidate["structured"].get("reset_5h_at"),
                 "reset_week_at": candidate["structured"].get("reset_week_at"),
                 "reset_at": candidate["structured"].get("reset_at"),
+                # Never backfilled from an older record: null means not blocked.
+                "rate_limit_reached": candidate["structured"].get("rate_limit_reached"),
                 "raw_status_text": candidate["structured"].get("raw_status_text"),
                 "_skip_5h_backfill": candidate["structured"].get("_skip_5h_backfill"),
             }