nomarmy 0.1.0-alpha.20 → 0.1.0-alpha.21

package/bin/nomarmy.mjs

@@ -31,16 +31,17 @@ import { loadAgents, readAgentsFile, writeAgentsFile, agentsConfigPath, apiAgent
 import { loadArmy, mergeArmy, describeArmy, readArmyFile, updateArmyInFile, assignRoleInFile, parseTargetSpec, armyLayerPath, globalConfigDir, DEFAULT_ARMY, ARMY_PHASES, LOCAL_CONFIG_FILENAME } from "../lib/army.mjs";
 import { parseLlamaUrl } from "../lib/execution.mjs";
 import { setupSteps, formatSetupSteps, runSetupPlaybook } from "../lib/setup-steps.mjs";
-import { readUsageSnapshots } from "../lib/usage-limits.mjs";
+import { readUsageSnapshots, refreshStaleOverLimitReadings } from "../lib/usage-limits.mjs";
 import { pickMachine, planResize } from "../lib/sandbox-vm.mjs";
 import { listProcesses, staleSessions, formatStaleSessions } from "../lib/stale-sessions.mjs";
 import { readSetting, writeSetting, writeEnvLine, userCommonPath, userProfilePath, profilePathFor, tildePath } from "../lib/user-config.mjs";
 import { MIN_PODMAN_VM_MB } from "../lib/doctor.mjs";
 import { liveLeases } from "../lib/slots.mjs";
 import { ensureProviderConfig } from "../lib/openclaw-config.mjs";
-import { recordProbeSuccess, parseOpenclawAuthProfiles } from "../lib/health.mjs";
+import { linkCodex } from "../lib/codex-link.mjs";
+import { recordProbeSuccess, parseOpenclawAuthProfiles, codexImportRecovery } from "../lib/health.mjs";
 import { pruneJobRuntime } from "../lib/prune.mjs";
-import { SUBSCRIPTION_VENDORS, parseOpenclawVersion, versionAtLeast, parseCatalogModels, parseCliLoginStatus, probeOutcome, parseMuseAuthDescriptor, extractMintedKey } from "../lib/subscription-setup.mjs";
+import { SUBSCRIPTION_VENDORS, parseOpenclawVersion, versionAtLeast, parseCatalogModels, parseCliLoginStatus, probeOutcome, openclawSignInFailure, parseMuseAuthDescriptor, extractMintedKey } from "../lib/subscription-setup.mjs";
 import { PINNED_OPENCLAW_VERSION, repairOpenclaw, verifyOpenclaw, configuredSubscriptionVendors } from "../lib/openclaw-install.mjs";
 import { ensureOpenClawOnPath } from "../lib/openclaw-path.mjs";
 import { THINKING_LEVELS } from "../lib/thinking.mjs";
@@ -174,7 +175,12 @@ Usage: nomarmy <command> [options]
                             --model --auth-env [--base-url]
                             [--openclaw-provider --plugin] [--register]
                             [--update-mcp] (api); --provider --model
-                            --owner (subscription); and optionally
+                            --owner (subscription). Codex JSON setup can
+                            --link-openclaw after CLI login; removing a
+                            capturing email profile non-interactively needs
+                            --remove-email-profiles. Interactive Codex setup
+                            offers removal (default yes), then imports the
+                            CLI login. For any kind, optionally
                             --max-concurrent --context-window
                             --thinking [minimal|low|medium|high|xhigh|adaptive|max|ultra] --no-thinking
                   update <name>
@@ -186,7 +192,7 @@ Usage: nomarmy <command> [options]
                             --no-model clears the default model, so every
                             role or job names its own.
                             (--json with the matching flags; --probe to
-                            test-call a subscription's new model first)
+                            test-call the agent; without a name, all agents)
                   remove <name>
                             remove one agent
   army <show|init|assign|general>
@@ -1256,6 +1262,7 @@ function catalogModelsFor(provider) {
 /** One real, one-token completion through OpenClaw to test a model. */
 // Why the last probeWorker() call failed, in the vendor's words when it said.
 let lastProbeFailure = null;
+let lastProbeText = "";
 function probeWorker(provider, model) {
   // The route a job takes: the ambient OpenClaw config and a state dir of
   // its own, never --isolated. --isolated skips that config, and with it the
@@ -1271,7 +1278,10 @@ function probeWorker(provider, model) {
       "--json", "--cwd", cwd, "--state-dir", stateDir, "--timeout", "90"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], cwd });
     // Streams kept apart: OpenClaw logs a "run ... ended" line to stderr
     // AFTER the JSON envelope, and the merged text doesn't parse.
-    const outcome = probeOutcome({ stdout: result.stdout ?? "", stderr: result.stderr ?? "" });
+    const stdout = result.stdout ?? "";
+    const stderr = result.stderr ?? "";
+    const outcome = probeOutcome({ stdout, stderr });
+    lastProbeText = `${stderr}\n${stdout}`;
     lastProbeFailure = outcome.ok ? null : outcome.reason;
     if (outcome.ok) recordProbeSuccess(agentStateRoot(), `${provider}/${model}`);
     return outcome.ok;
@@ -1303,10 +1313,15 @@ function reapProbeSandbox(stateDir) {
 /**
  * OpenClaw's own provider login, for the vendors whose plugin wants one on
  * top of the vendor CLI's login (Claude doesn't: OpenClaw reuses the CLI
- * session directly). Run when the catalog or auth-profile check shows
- * linking is needed, never preemptively.
+ * session directly). Codex always refreshes its imported copy after CLI
+ * login is confirmed; other providers link when catalog or auth checks fail.
  */
-function openclawProviderLogin(vendor) {
+async function openclawProviderLogin(vendor, rl) {
+  if (vendor === SUBSCRIPTION_VENDORS.codex) return linkCodex({
+    run: runQuiet, command: openclawCmd(), isTTY: Boolean(input.isTTY),
+    removeEmailProfiles: flag("remove-email-profiles"),
+    confirm: (prompt, opts) => confirm(rl, prompt, opts), print: (message) => console.log(c.dim(message)),
+  });
   const provider = vendor.credential.loginProvider ?? vendor.provider;
   console.log(c.dim(`Linking OpenClaw to it (\`openclaw models auth login --provider ${provider}\`) -- follow its prompts:`));
   const ok = runInteractive(openclawCmd(), ["models", "auth", "login", "--provider", provider]);
@@ -1575,16 +1590,23 @@ async function addSubscriptionAgent(rl, agents) {
   console.log(`\n${c.bold("→")} Models`);
   const needsOpenclawLogin = vendor.credential.kind === "openclaw-login";
   let linkedOpenclaw = false;
+  if (vendorKey === "codex") {
+    linkedOpenclaw = await openclawProviderLogin(vendor, rl);
+    if (!linkedOpenclaw) {
+      console.log(c.red("✗ Sign-in has no usable auth profile. Retry with `nomarmy agents add subscription codex`."));
+      process.exitCode = 1; return;
+    }
+  }
   let models = catalogModelsFor(vendor.provider);
-  if (!models.length && needsOpenclawLogin) {
-    linkedOpenclaw = openclawProviderLogin(vendor);
+  if (!models.length && needsOpenclawLogin && !linkedOpenclaw) {
+    linkedOpenclaw = await openclawProviderLogin(vendor, rl);
     if (!linkedOpenclaw) { console.log(c.red(`✗ Sign-in failed or was canceled. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`)); process.exitCode = 1; return; }
     models = catalogModelsFor(vendor.provider);
   }
   // Catalog entries can be cached, and a particular model can refuse a
   // working login. Check OpenClaw's auth profile before asking for details.
   if (needsOpenclawLogin && !hasUsableOpenclawAuthProfile(vendor.provider)) {
-    if (linkedOpenclaw || !openclawProviderLogin(vendor) || !hasUsableOpenclawAuthProfile(vendor.provider)) {
+    if (linkedOpenclaw || !(await openclawProviderLogin(vendor, rl)) || !hasUsableOpenclawAuthProfile(vendor.provider)) {
       console.log(c.red(`✗ Sign-in has no usable auth profile. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`));
       process.exitCode = 1;
       return;
@@ -1598,7 +1620,8 @@ async function addSubscriptionAgent(rl, agents) {
   const pick = (await rl.question(c.bold(`Default model, optional${models.length ? " (a number or an id)" : ""}; blank = pick per role: `))).trim();
   const model = /^\d+$/.test(pick) && models.length ? models[Number(pick) - 1] : pick || null;
   if (pick && !model) throw new Error(`Not a valid choice: "${pick}".`);
-  // The test call needs some model; it checks the model, not the login.
+  // A usable profile is only a fast precondition. The test call is what
+  // proves sign-in: an unexpired Codex import can still answer 401.
   const probeModel = model ?? models[0] ?? vendor.defaultModel;
 
   const ownerDefault = validOwnerEmail(auth.email) ? auth.email : gitUserEmail();
@@ -1611,9 +1634,17 @@ async function addSubscriptionAgent(rl, agents) {
   if (!name) { console.log(c.dim("Stopped; nothing was written.")); return; }
 
   console.log(`\n${c.bold("→")} Test call`);
-  const works = probeModel ? probeWorker(vendor.provider, probeModel) : false;
+  const probed = Boolean(probeModel);
+  const works = probed ? probeWorker(vendor.provider, probeModel) : false;
   if (works) console.log(c.green(`✓ ${vendor.provider}/${probeModel} answered a real test prompt.`));
-  else {
+  else if (needsOpenclawLogin && probed && openclawSignInFailure(`${lastProbeFailure ?? ""}\n${lastProbeText}`)) {
+    const why = lastProbeFailure ? `: ${lastProbeFailure}` : "";
+    console.log(c.red(`✗ Sign-in failed${why}.`));
+    console.log(`  fix: ${codexImportRecovery()}`);
+    console.log(c.dim("Stopped; nothing was written."));
+    process.exitCode = 1;
+    return;
+  } else {
     console.log(c.yellow(probeModel ? `⚠ The login works, but ${vendor.provider}/${probeModel} didn't answer a real test prompt.` : "⚠ The login works, but no model is available for a test call."));
     console.log(c.dim(`You can retry later with \`nomarmy agents update ${name} --probe\`.`));
     if (!(await confirm(rl, "Save the agent anyway?", { defaultYes: false }))) {
@@ -1648,6 +1679,15 @@ async function cmdAgentsAddJson() {
     const thinking = resolveThinkingFlag();
     if (thinking !== undefined) agent.thinking = thinking;
   }
+  if (kind === "subscription" && agent.provider === "openai" && (flag("link-openclaw") || flag("remove-email-profiles"))) {
+    if (!readLoginStatus("codex").loggedIn) throw new Error("Confirm Codex CLI login first: codex login");
+    const linked = await linkCodex({ run: runQuiet, command: openclawCmd(),
+      removeEmailProfiles: flag("remove-email-profiles"), print: (message) => console.error(message) });
+    if (!linked) throw new Error("Codex import failed; nothing was written.");
+    if (!probeWorker("openai", agent.model ?? SUBSCRIPTION_VENDORS.codex.defaultModel)) {
+      throw new Error(`Codex test call failed; nothing was written. Fix: ${codexImportRecovery()}`);
+    }
+  }
   const written = saveAgents({ ...agents, [name]: agent });
   const saved = written[name];
   let registered = null, mcpUpdated = false;
@@ -1730,7 +1770,7 @@ async function cmdAgentsUpdate() {
     if (flag("owner") || value("owner") !== null || value("provider") !== null || value("kind") !== null) {
       throw new Error("Kind, provider and owner can't be changed -- that's a different agent. Use `nomarmy agents add`.");
     }
-    probe = flag("probe") && current.kind === "subscription";
+    probe = flag("probe");
     if (!Object.keys(changes).length && !probe) throw new Error("Nothing to update -- pass at least one field flag (see `nomarmy agents update` usage).");
   } else {
     if (!process.stdin.isTTY) throw new Error("nomarmy agents update needs an interactive terminal, or the flags to change (e.g. --max-concurrent 3).");
@@ -1779,7 +1819,7 @@ async function cmdAgentsUpdate() {
   }
 
   if (probe && !Object.keys(changes).length) { probeConfiguredAgent(name, current); return; }
-  if (probe && changes.model && !probeWorker(current.provider, changes.model)) {
+  if (probe && changes.model && !probeWorker(agentProviderId(current), changes.model)) {
     out({ error: `a real test prompt to ${current.provider}/${changes.model} didn't come back -- nothing was written` });
     process.exit(1);
   }
@@ -2405,7 +2445,7 @@ function armyLayerFlag(fallback = "global") {
   return chosen[0] ?? fallback;
 }
 
-function loadArmyForCli({ globalOnly = false } = {}) {
+function loadArmyForCli({ globalOnly = false, usageRefresh = null } = {}) {
   const agents = loadAgentsOrExit().agents;
   const loaded = globalOnly
     ? (() => {
@@ -2414,8 +2454,8 @@ function loadArmyForCli({ globalOnly = false } = {}) {
         return { ...mergeArmy([{ layer: "global", army }]), layers: [{ layer: "global", path: filePath, exists: fs.existsSync(filePath), hasArmy: Boolean(army) }] };
       })()
     : loadArmy({ projectDir: repoDir });
-  const usageSnapshots = readUsageSnapshots(process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents"));
-  return { loaded, agents, summary: describeArmy(loaded, { agents, describeAgent: describeAgentLabel, usageSnapshots, agentProviderId }) };
+  const usageSnapshots = usageRefresh?.snapshots ?? readUsageSnapshots(process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents"));
+  return { loaded, agents, summary: describeArmy(loaded, { agents, describeAgent: describeAgentLabel, usageSnapshots, agentProviderId, usageRefreshError: usageRefresh?.error ?? null, usageRefreshFailed: usageRefresh?.failedProviders ?? null }) };
 }
 
 // Claude Code adds settings.local.json to .gitignore for the same reason:
@@ -2453,7 +2493,9 @@ function repositoryHere(dir) {
 
 async function cmdArmyShow() {
   const inRepository = repositoryHere(repoDir);
-  const { summary } = loadArmyForCli({ globalOnly: !inRepository });
+  const stateRoot = process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents");
+  const usageRefresh = await refreshStaleOverLimitReadings(stateRoot);
+  const { summary } = loadArmyForCli({ globalOnly: !inRepository, usageRefresh });
   if (json) return out(summary);
   const g = summary.general;
   console.log(c.bold("🪖 nomArmy") + (inRepository ? c.dim(`  (${repoDir})`) : ""));
@@ -2920,6 +2962,7 @@ async function cmdHealth() {
   const { checkAndRecordHealth } = await import("../lib/health.mjs");
   const stateRoot = process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents");
   const { result } = await checkAndRecordHealth({ projectDir: repoDir, stateRoot, configDir: globalConfigDir(), env: installEnv() });
+  if (result.issues.some((i) => i.severity === "error")) process.exitCode = 1;
   if (json) return out(result);
   console.log(c.bold("🍪 nomArmy health") + c.dim(`  ${new Date(result.checkedAt).toLocaleString()}`));
   if (!result.issues.length) { console.log(c.green("\n✓ Nothing to fix.")); return; }
@@ -3150,7 +3193,10 @@ async function cmdDoctor() {
   }
   // Import lazily to avoid circular dependencies
   const { runDoctor } = await import("../lib/doctor.mjs");
-  const vendors = configuredSubscriptionVendors(loadAgentsOrExit().agents);
+  const agents = loadAgentsOrExit().agents;
+  const vendors = configuredSubscriptionVendors(agents);
+  let armySummary = null;
+  try { armySummary = describeArmy(loadArmy({ projectDir: repoDir }), { agents }); } catch { /* other doctor checks still run */ }
   let checks;
   if (flag("fix")) {
     const repaired = await repairOpenclaw({
@@ -3166,7 +3212,8 @@ async function cmdDoctor() {
   } else {
     checks = verifyOpenclaw({ command: openclawCmd(), vendors });
   }
-  await runDoctor({ json, exit: true, env: installEnv(), additionalChecks: checks });
+  await runDoctor({ json, exit: true, env: installEnv(), additionalChecks: checks,
+    runtime: { agents, armySummary, openclawCmd: openclawCmd() } });
 }
 commands.doctor = cmdDoctor;
 if (windowsFrontEnd() && windowsPlan(argv) === "FORWARD") {

package/lib/admission.mjs

@@ -11,7 +11,7 @@ import { readJson } from "./openclaw-run.mjs";
 import { readOpenClawTranscriptTail } from "./transcript.mjs";
 import { readClaudeSessionTranscript } from "./claude-transcript.mjs";
 import { notify } from "./notify.mjs";
-import { readCodexRateLimits, recordUsageSnapshot, readUsageSnapshots, usageStatus } from "./usage-limits.mjs";
+import { readCodexRateLimits, recordUsageSnapshot, readUsageSnapshots, usageStatus, usageDisplayText, refreshStaleOverLimitReadings, staleUsageRefreshedNote, USAGE_STALE_MINUTES } from "./usage-limits.mjs";
 import { projectDirProblem } from "./server-context.mjs";
 import { recentModelRefusal, refusedModelIn, recordModelRefusal, recordProbeSuccess, modelProven, modelRefusals, claimModelRefusalRetry } from "./health.mjs";
 import { writeLease, removeLease, liveLeases, liveSlots, acquireSlot } from "./slots.mjs";
@@ -181,7 +181,7 @@ export function createJobRuntime(deps) {
   function admissionHardware() {
     return executionMode(deps.env).managesModelServer ? deps.budgetState.hardwareSnapshot : null;
   }
-  function capacitySnapshot() {
+  function capacitySnapshot(usageOverride = null) {
     const admission = assessAdmission({ hardware: admissionHardware(), runningJobs: runningCount("local"), slots: deps.budgetState.contextInfo.slots, maxWorkers: currentMaxWorkers() });
     return {
       // The local model's budget. An api or subscription job's scales with
@@ -191,7 +191,10 @@ export function createJobRuntime(deps) {
       admission,
       memory: deps.budgetState.hardwareSnapshot?.memory ?? null,
       running: [...activeJobs.values()].filter(j => !j.settled).map(j => ({ jobId: j.jobId, workerId: j.workerId, mode: j.mode, lane: j.lane, startedAt: j.startedAt, phase: readJson(path.join(jobsRoot, j.jobId, "status.json"))?.phase ?? "starting" })),
-      usageLimits: Object.fromEntries(Object.entries(readUsageSnapshots(stateRoot)).map(([provider, snapshot]) => [provider, usageStatus(snapshot)])),
+      usageLimits: Object.fromEntries(Object.entries(usageOverride ?? readUsageSnapshots(stateRoot)).map(([provider, snapshot]) => {
+        const status = usageStatus(snapshot);
+        return [provider, { ...status, text: usageDisplayText(status) }];
+      })),
       maxWorkers: currentMaxWorkers(),
       remote: (() => { const limit = maxJobs(); return { running: runningCount("remote"), maxWorkers: limit.value, setBy: limit.source === "file" ? limit.path : limit.source === "env" ? "NOMARMY_MAX_POOL_WORKERS" : "default", note: "api and subscription agents; each agent's own max_concurrent also applies. Change with `nomarmy config max-jobs <n>`." }; })()
     };
@@ -205,16 +208,38 @@ export function createJobRuntime(deps) {
     // Every job needs its sandbox; the server wires the Podman check (tests don't).
     const noSandbox = deps.sandboxProblem ? deps.sandboxProblem() : null;
     if (noSandbox) problems.push(noSandbox);
-    const snapshots = readUsageSnapshots(stateRoot);
+    const usageNow = deps.now?.() ?? Date.now();
+    let snapshots = readUsageSnapshots(stateRoot);
+    const providerFor = (job) => {
+      if (job.mode === "verify" || !job.agentName || job.confirm_over_limit === true) return null;
+      try { return agentProviderId(agentsConfig().agents[job.agentName]) ?? null; } catch { return null; }
+    };
+    const held = [];
     jobs.forEach((j, i) => {
-      if (j.mode === "verify" || !j.agentName || j.confirm_over_limit === true) return;
-      let provider;
-      try { provider = agentProviderId(agentsConfig().agents[j.agentName]); } catch { return; }
-      const snapshot = snapshots[provider];
-      if (!snapshot) return;
-      const status = usageStatus(snapshot);
-      if (status.level === "over") problems.push(`${jobs.length > 1 ? `job ${i + 1}: ` : ""}agent "${j.agentName}" is held at its usage limit: ${status.text} (reading ${status.ageMinutes} minutes old). Ask the operator before resubmitting with confirm_over_limit: true, or send the job to another agent.`);
+      const provider = providerFor(j);
+      if (!provider || !snapshots[provider]) return;
+      const status = usageStatus(snapshots[provider], usageNow);
+      if (status.level === "over") held.push({ i, j, provider, status });
     });
+    const usageNotes = [];
+    let failedProviders = new Set();
+    let refreshError = null;
+    if (held.some((item) => item.status.ageMinutes >= USAGE_STALE_MINUTES)) {
+      const refreshed = await refreshStaleOverLimitReadings(stateRoot, { run: deps.usageRun, now: usageNow, snapshots, timeoutMs: deps.usageRefreshTimeoutMs });
+      snapshots = refreshed.snapshots;
+      refreshError = refreshed.error;
+      failedProviders = new Set(refreshed.failedProviders ?? []);
+    }
+    const cleared = new Set();
+    for (const item of held) {
+      const status = snapshots[item.provider] ? usageStatus(snapshots[item.provider], usageNow) : item.status;
+      if (status.level !== "over") {
+        if (!cleared.has(item.provider)) { cleared.add(item.provider); usageNotes.push(staleUsageRefreshedNote(item.provider)); }
+        continue;
+      }
+      const extra = failedProviders.has(item.provider) ? ` ${refreshError ?? "OpenClaw usage refresh failed"}.` : "";
+      problems.push(`${jobs.length > 1 ? `job ${item.i + 1}: ` : ""}agent "${item.j.agentName}" is held at its usage limit: ${status.text} (reading ${status.ageMinutes} minutes old).${extra} Ask the operator before resubmitting with confirm_over_limit: true, or send the job to another agent.`);
+    }
     // A pool-routed job is checked against that pool's OWN (model-dependent)
     // budget, not the local-derived global one -- see budgetsForPool. Which
     // specific entry pickProvider will land on isn't known yet at admission
@@ -370,9 +395,23 @@ export function createJobRuntime(deps) {
         problems.push(`not admitted (capacity): ${runningRemote} remote job(s) (api or subscription agents) already running, the limit of ${remoteCeiling} at once (raise it with \`nomarmy config max-jobs <n>\`)`);
       }
     }
+    for (const note of usageNotes) admission.reasons.push(note);
     return { problems, admission };
   }
 
+  async function displayedCapacity() {
+    const now = deps.now?.() ?? Date.now();
+    const refreshed = await refreshStaleOverLimitReadings(stateRoot, { run: deps.usageRun, now, timeoutMs: deps.usageRefreshTimeoutMs });
+    const view = capacitySnapshot(refreshed.snapshots);
+    if (refreshed.error) {
+      for (const provider of refreshed.failedProviders ?? []) {
+        if (!view.usageLimits[provider]) continue;
+        view.usageLimits[provider] = { ...view.usageLimits[provider], text: `${view.usageLimits[provider].text}. ${refreshed.error}` };
+      }
+    }
+    return view;
+  }
+
   function refusal(problems) {
     return toolText(refusalText(problems, capacitySnapshot), true);
   }
@@ -481,5 +520,5 @@ export function createJobRuntime(deps) {
     return out;
   }
 
-  return { WORKER_START_STAGGER_MS, activeJobs, runningCount, agentMaxConcurrent, withAgentSlot, track, notifyJobFinished, capacitySnapshot, admit, refusal, runBrief, recordJobInRun, trackInRun, launch, liveProgress, summarize };
+  return { WORKER_START_STAGGER_MS, activeJobs, runningCount, agentMaxConcurrent, withAgentSlot, track, notifyJobFinished, capacitySnapshot, displayedCapacity, admit, refusal, runBrief, recordJobInRun, trackInRun, launch, liveProgress, summarize };
 }

package/lib/army.mjs

@@ -31,7 +31,7 @@ import YAML from "yaml";
 import { z } from "zod";
 import { typeError } from "./zod-issues.mjs";
 import { agentRunsToolsOnHost } from "./dispatch-schema.mjs";
-import { usageStatus } from "./usage-limits.mjs";
+import { usageStatus, usageDisplayText } from "./usage-limits.mjs";
 
 export const GLOBAL_CONFIG_FILENAME = "config.yml";
 export const PROJECT_CONFIG_FILENAMES = Object.freeze([".nomarmy.yml", ".nomarmy.yaml"]);
@@ -365,7 +365,7 @@ export function generalOverlap(army, agents = {}) {
  * description, phase, suggested mode, agent, any problem or overlap with
  * the General, and which layer set each field.
  */
-export function describeArmy(loaded, { agents = {}, describeAgent = null, usageSnapshots = null, agentProviderId = null, now = Date.now() } = {}) {
+export function describeArmy(loaded, { agents = {}, describeAgent = null, usageSnapshots = null, agentProviderId = null, now = Date.now(), usageRefreshError = null, usageRefreshFailed = null } = {}) {
   const army = loaded.army;
   const problems = armyTargetProblems(army, agents);
   const overlap = generalOverlap(army, agents);
@@ -376,8 +376,10 @@ export function describeArmy(loaded, { agents = {}, describeAgent = null, usageS
     try { provider = agentProviderId(agents[name]); } catch { return null; }
     const snapshot = usageSnapshots[provider];
     if (!snapshot) return null;
-    const { level, text } = usageStatus(snapshot, now);
-    return { level, text };
+    const status = usageStatus(snapshot, now);
+    const failed = new Set(usageRefreshFailed ?? []);
+    const text = failed.has(provider) && usageRefreshError ? `${usageDisplayText(status)}. ${usageRefreshError}` : usageDisplayText(status);
+    return { level: status.level, text };
   };
   // A subscription whose owner isn't the General's own is worth a word,
   // not a refusal: it may be the same person's other account (a real Senti

package/lib/codex-link.mjs

@@ -0,0 +1,37 @@
+import os from "node:os";
+import path from "node:path";
+import { parseOpenclawAuthProfiles } from "./health.mjs";
+import { CODEX_IMPORT_ARGS, CODEX_IMPORT_RECOVERY, emailOpenaiProfiles, usableCodexImport } from "./openclaw-runtime-health.mjs";
+
+// Never relay migration output: --include-secrets may expose credential data.
+export async function linkCodex({ run, command = "openclaw", isTTY = false, removeEmailProfiles = false, confirm = async () => false, print = () => {}, codexDir = path.join(os.homedir(), ".codex"), now = Date.now() }) {
+  const read = async () => {
+    const result = await run(command, ["models", "auth", "list", "--json"]);
+    return result.ok ? parseOpenclawAuthProfiles(result.stdout) : null;
+  };
+  const profiles = await read();
+  if (!profiles) { print("Cannot inspect OpenClaw auth profiles; nothing imported."); return false; }
+  const emails = emailOpenaiProfiles(profiles);
+  if (emails.length) {
+    print(`Email-keyed profiles will capture the Codex import: ${emails.map((p) => p.id).join(", ")}.`);
+    if (!removeEmailProfiles && !(isTTY && await confirm("Remove these email-keyed profiles before importing?", { defaultYes: true }))) {
+      print("Stopped; use --remove-email-profiles to allow removal non-interactively.");
+      return false;
+    }
+    for (const p of emails) {
+      if (!(await run(command, ["models", "auth", "logout", p.id])).ok) { print("OpenClaw profile logout failed; nothing imported."); return false; }
+    }
+    const remaining = await read();
+    if (!remaining || emailOpenaiProfiles(remaining).length) { print("Email-keyed profiles still exist; nothing imported."); return false; }
+  }
+  print(`Linking OpenClaw: ${CODEX_IMPORT_RECOVERY}`);
+  const args = CODEX_IMPORT_ARGS.map((arg) => arg === "~/.codex" ? codexDir : arg);
+  if (!(await run(command, args)).ok) { print("Codex import failed."); return false; }
+  const imported = await read();
+  if (!imported || emailOpenaiProfiles(imported).length || !usableCodexImport(imported, now)) {
+    print("Sign-in has no usable auth profile: expected an unexpired openai:account- profile labeled (Codex import).");
+    return false;
+  }
+  print("Confirmed an unexpired openai:account- (Codex import) profile.");
+  return true;
+}

package/lib/connect.mjs

@@ -434,7 +434,7 @@ export function portableServerLaunch({ nomarmyRoot, installDir = defaultInstallD
 }
 
 /** The on-disk server scripts registered by connect for this repository. */
-export async function registeredMcpCopies({ projectDir = null, installDir = defaultInstallDir(), nomarmyRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."), run }) {
+export async function registeredMcpCopies({ projectDir = null, installDir = defaultInstallDir(), nomarmyRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."), cursorConfigPath = defaultCursorConfigPath(), homeDir = os.homedir(), run }) {
   const copies = [];
   const add = (target, scope, command, args = []) => {
     let serverPath = null;
@@ -458,7 +458,7 @@ export async function registeredMcpCopies({ projectDir = null, installDir = defa
     if (scope && command) add("claude", scope, command, args ? [args] : []);
   };
   claude(await output("claude", ["mcp", "get", SERVER_NAME], projectDir || undefined));
-  if (projectDir) claude(await output("claude", ["mcp", "get", SERVER_NAME], os.homedir()));
+  if (projectDir) claude(await output("claude", ["mcp", "get", SERVER_NAME], homeDir));
   const codex = await output("codex", ["mcp", "get", SERVER_NAME, "--json"]);
   if (codex) {
     try {
@@ -466,7 +466,7 @@ export async function registeredMcpCopies({ projectDir = null, installDir = defa
       if (transport) add("codex", "user", transport.command, transport.args);
     } catch { /* no registration */ }
   }
-  for (const [scope, configPath] of [["user", defaultCursorConfigPath()], ...(projectDir ? [["local", path.join(projectDir, ".cursor", "mcp.json")]] : [])]) {
+  for (const [scope, configPath] of [["user", cursorConfigPath], ...(projectDir ? [["local", path.join(projectDir, ".cursor", "mcp.json")]] : [])]) {
     try {
       const entry = readCursorConfig(configPath).mcpServers?.[SERVER_NAME];
       if (entry) add("cursor", scope === "local" && entry.command === PORTABLE_SERVER.command ? "project" : scope, entry.command, entry.args);

package/lib/doctor.mjs

@@ -553,7 +553,10 @@ export function evaluateChecks(facts) {
 export async function runDoctor(opts = {}) {
   const { json = false, exit = false, env = process.env } = opts;
   const facts = opts.facts ?? await collectFacts(env);
-  const checks = [...evaluateChecks(facts), ...(opts.additionalChecks ?? [])];
+  const { runtimeIssues } = await import("./health.mjs");
+  const runtime = opts.runtime ? await runtimeIssues(opts.runtime) : [];
+  const checks = [...evaluateChecks(facts), ...(opts.additionalChecks ?? []),
+    ...runtime.map((issue) => ({ id: issue.id, ok: false, message: `${issue.title}. ${issue.detail}`, fix: issue.fix }))];
   const allOk = checks.every((c) => c.ok);
   const result = { ok: allOk, checks };
 

package/lib/health.mjs

@@ -4,7 +4,8 @@
 // stall the server that runs it.
 //
 //   login-expiry     an OAuth login (the ChatGPT plan's Codex import) about
-//                    to expire or already expired
+//                    to expire or already expired. The import is a copy of
+//                    Codex's own login; re-import it, don't run agents add.
 //   openclaw-update  OpenClaw older than npm's latest (a stale 2026.9.5
 //                    catalog made gpt-6-sol look unavailable)
 //   plugin-skew      an OpenClaw plugin older than OpenClaw itself
@@ -21,10 +22,11 @@
 import { execFile } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import { codexImportRecovery, codexImportIssues, modelPolicyIssues } from "./openclaw-runtime-health.mjs";
 import { executionMode } from "./execution.mjs";
 import { modelRejection } from "./openclaw-errors.mjs";
 import { providerConfigured, readOpenclawConfig } from "./openclaw-config.mjs";
-import { readUsageSnapshots, usageStatus } from "./usage-limits.mjs";
+import { readUsageSnapshots, usageStatus, usageDisplayText, usageReadingIsStale, refreshStaleOverLimitReadings } from "./usage-limits.mjs";
 import { freshnessIssues, readInstallVersions } from "./install-freshness.mjs";
 
 import { PINNED_OPENCLAW_VERSION } from "./openclaw-install.mjs";
@@ -49,18 +51,59 @@ export function parseOpenclawAuthProfiles(stdout) {
   } catch { return null; }
 }
 
+export { CODEX_IMPORT_RECOVERY, codexImportRecovery } from "./openclaw-runtime-health.mjs";
+
+function profileUsable(profile, now) {
+  if (profile?.expiresAt == null || profile.expiresAt === "") return true;
+  const expires = Date.parse(profile.expiresAt);
+  return Number.isFinite(expires) && expires > now;
+}
+
+function profileName(profile) {
+  const id = String(profile.id ?? profile.provider ?? "unknown");
+  const raw = [profile.label, profile.name, profile.displayName].find((value) => typeof value === "string" && value.trim());
+  if (!raw) return id;
+  const label = raw.trim();
+  if (label === id || label.startsWith(`${id} `)) return label;
+  return label.startsWith("(") ? `${id} ${label}` : `${id} (${label})`;
+}
+
 /** OAuth profiles near or past expiry, from `openclaw models auth list --json`. */
 export function loginExpiryIssues(authJson, { now = Date.now(), warnDays = 7 } = {}) {
+  const profiles = authJson?.profiles ?? [];
   const issues = [];
-  for (const p of authJson?.profiles ?? []) {
+  for (const p of profiles) {
     const at = Date.parse(p.expiresAt ?? "");
     if (!Number.isFinite(at)) continue;
     const days = Math.floor((at - now) / DAY);
     const who = p.provider === "openai" ? "Codex (ChatGPT plan)" : p.provider;
-    const fix = p.provider === "openai" ? "nomarmy agents add subscription codex  (then replace the existing codex agent)" : `openclaw models auth login --provider ${p.provider}`;
-    if (at <= now) issues.push({ id: `login-expired:${p.id}`, severity: "error", title: `${who} login has expired`, detail: `Auth profile ${p.provider} expired ${new Date(at).toISOString().slice(0, 10)}; every job on it will fail.`, fix, short: `${p.provider} login expired` });
-    else if (at - now <= warnDays * DAY) issues.push({ id: `login-expiring:${p.id}`, severity: "warn", title: `${who} login expires in ${days} day${days === 1 ? "" : "s"}`, detail: `Auth profile ${p.provider} expires ${new Date(at).toISOString().slice(0, 10)}.`, fix, short: `${p.provider} login ${days}d` });
+    const name = profileName(p);
+    const expired = at <= now;
+    const siblingValid = profiles.some((other) => other !== p && other.provider === p.provider && other.id !== p.id && profileUsable(other, now));
+    const fix = p.provider === "openai" ? codexImportRecovery({ profiles }) : `openclaw models auth login --provider ${p.provider}`;
+    if (expired) {
+      const detail = siblingValid
+        ? `Auth profile ${name} expired ${new Date(at).toISOString().slice(0, 10)}. OpenClaw may still pick it.`
+        : `Auth profile ${name} expired ${new Date(at).toISOString().slice(0, 10)}; every job on it will fail.`;
+      issues.push({ id: `login-expired:${p.id}`, severity: "error", title: `${who} login has expired: ${name}`, detail, fix, short: `${p.provider} login expired` });
+    } else if (at - now <= warnDays * DAY) issues.push({ id: `login-expiring:${p.id}`, severity: "warn", title: `${who} login expires in ${days} day${days === 1 ? "" : "s"}: ${name}`, detail: `Auth profile ${name} expires ${new Date(at).toISOString().slice(0, 10)}.`, fix, short: `${p.provider} login ${days}d` });
+  }
+  return issues;
+}
+
+/** Shared runtime preconditions for doctor and health. */
+export async function runtimeIssues({ run = runBounded, openclawCmd = process.env.NOMARMY_OPENCLAW_CMD || "openclaw", openclawAgent = "main", agents = {}, armySummary = null, modelsInUse = null, now = Date.now() } = {}) {
+  const paths = [`agents.entries.${openclawAgent}.modelPolicy.allow`, "agents.defaults.modelPolicy.allow"];
+  const [auth, ...policies] = await Promise.all([
+    run(openclawCmd, ["models", "auth", "list", "--json"]),
+    ...paths.map((p) => run(openclawCmd, ["config", "get", p, "--json"])),
+  ]);
+  const profiles = auth.ok ? parseOpenclawAuthProfiles(auth.stdout) : null;
+  const issues = profiles ? loginExpiryIssues({ profiles }, { now }) : [];
+  if (Object.values(agents ?? {}).some((a) => a.kind === "subscription" && a.provider === "openai")) {
+    issues.push(...codexImportIssues(profiles ?? [], { now }));
   }
+  issues.push(...modelPolicyIssues({ policies, paths, agents, armySummary, modelsInUse }));
   return issues;
 }
 
@@ -241,33 +284,41 @@ export function leftoverIssues({ retainedWorktrees = 0, jobsBytes = 0, staleRunn
  * Run every check. `env` supplies what each needs, with real defaults;
  * tests pass their own.
  */
-export async function runHealthChecks({ now = Date.now(), mode = "local", openclawCmd = process.env.NOMARMY_OPENCLAW_CMD || "openclaw", run = runBounded, armySummary = null, agentsError = null, jobsRoot = null, pidAlive = () => true, agents = null, openclawConfig = null, vendors = {}, modelsInUse = null, autoPruned = null, usageSnapshots = null, install = null } = {}) {
+export async function runHealthChecks({ now = Date.now(), mode = "local", openclawCmd = process.env.NOMARMY_OPENCLAW_CMD || "openclaw", run = runBounded, armySummary = null, agentsError = null, jobsRoot = null, pidAlive = () => true, agents = null, openclawConfig = null, vendors = {}, modelsInUse = null, autoPruned = null, usageSnapshots = null, stateRoot = null, install = null } = {}) {
   const issues = [];
   if (autoPruned?.freedBytes) issues.push({ id: `auto-prune:${new Date(now).toISOString()}`, severity: "info",
     title: `Freed ${(autoPruned.freedBytes / 1024 ** 3).toFixed(2)} GB: ${[autoPruned.pruned ? `runtime data of ${autoPruned.pruned} finished job${autoPruned.pruned === 1 ? "" : "s"} older than ${autoPruned.olderThanHours}h` : null, autoPruned.scratchCleared ? `OpenClaw scratch files of ${autoPruned.scratchCleared} more` : null].filter(Boolean).join(", ")}`,
     detail: "Automatic; each job's record and report are kept. NOMARMY_AUTO_PRUNE_HOURS sets the age (0 turns it off).", fix: null, short: null });
   if (agents) issues.push(...providerConfigIssues({ agents, openclawConfig, vendors }));
-  if (usageSnapshots) {
-    for (const [provider, snapshot] of Object.entries(usageSnapshots)) {
+  usageSnapshots ??= stateRoot ? readUsageSnapshots(stateRoot) : null;
+  const staleOver = usageSnapshots && Object.values(usageSnapshots).some((snapshot) => usageReadingIsStale(usageStatus(snapshot, now)));
+  const [runtime, version, latest, plugins, nomarmyLatest, refreshed] = await Promise.all([
+    runtimeIssues({ run, openclawCmd, agents, armySummary, modelsInUse, now }),
+    run(openclawCmd, ["--version"]),
+    run("npm", ["view", "openclaw", "version"], { timeoutMs: 15000 }),
+    run(openclawCmd, ["plugins", "inspect", "codex"]),
+    install ? run("npm", ["view", "nomarmy", "dist-tags.alpha"], { timeoutMs: 15000 }) : null,
+    staleOver ? refreshStaleOverLimitReadings(stateRoot, { run, now, snapshots: usageSnapshots, openclawCmd }) : null,
+  ]);
+  const snapshots = refreshed?.snapshots ?? usageSnapshots;
+  const failedProviders = new Set(refreshed?.failedProviders ?? []);
+  if (snapshots) {
+    for (const [provider, snapshot] of Object.entries(snapshots)) {
       const status = usageStatus(snapshot, now);
       if (status.level === "ok") continue;
       const short = `${provider} ${status.short}`;
+      const stale = usageReadingIsStale(status);
+      const detail = stale
+        ? `${usageDisplayText(status)}.${failedProviders.has(provider) ? ` ${refreshed.error}.` : ""}`
+        : `${status.text} (reading ${status.ageMinutes} minutes old).`;
       issues.push({ id: `usage:${provider}:${status.level}`, severity: "warn", title: status.level === "over" ? `${provider} is at its usage limit` : `${provider} usage is ${status.short}`,
-        detail: `${status.text} (reading ${status.ageMinutes} minutes old).`,
+        detail,
         fix: status.level === "over" ? "wait for the reset, or move its roles with nomarmy army assign" : "plan remaining work or move its roles with nomarmy army assign",
         short });
     }
   }
-  const [auth, version, latest, plugins, nomarmyLatest] = await Promise.all([
-    run(openclawCmd, ["models", "auth", "list", "--json"]),
-    run(openclawCmd, ["--version"]),
-    run("npm", ["view", "openclaw", "version"], { timeoutMs: 15000 }),
-    run(openclawCmd, ["plugins", "inspect", "codex"]),
-    install ? run("npm", ["view", "nomarmy", "dist-tags.alpha"], { timeoutMs: 15000 }) : null,
-  ]);
   if (install) issues.push(...freshnessIssues({ ...install, latestVersion: nomarmyLatest?.ok ? nomarmyLatest.stdout : null }));
-  const authProfiles = auth.ok ? parseOpenclawAuthProfiles(auth.stdout) : null;
-  if (authProfiles) issues.push(...loginExpiryIssues({ profiles: authProfiles }, { now }));
+  issues.push(...runtime);
   const pluginVersion = /Version:\s*(\S+)/.exec(plugins.stdout ?? "")?.[1];
   if (version.ok) issues.push(...versionIssues({ installed: version.stdout, latest: latest.ok ? latest.stdout : null, plugins: pluginVersion ? [{ id: "codex", version: pluginVersion }] : [] }));
   if (agentsError) issues.push({ id: `config:agents:${agentsError}`, severity: "error", title: "agents.yml can't be loaded", detail: agentsError, fix: "nomarmy agents list (shows the problem)", short: "agents.yml broken" });
@@ -318,10 +369,10 @@ export function recordHealth(file, result, { now = Date.now() } = {}) {
 }
 
 /** Read versions and harnesses only from MCP registrations that launch nomArmy. */
-export async function readRegisteredInstall({ projectDir, run = runBounded, installDir } = {}) {
+export async function readRegisteredInstall({ projectDir, run = runBounded, installDir, cursorConfigPath, homeDir } = {}) {
   const { registeredMcpCopies } = await import("./connect.mjs");
   const { loadHarnesses } = await import("./harnesses.mjs");
-  const registered = await registeredMcpCopies({ projectDir, run, installDir });
+  const registered = await registeredMcpCopies({ projectDir, run, installDir, cursorConfigPath, homeDir });
   if (!registered.length) return null;
   return { registrations: registered.map(({ target, scope, serverPath }) => {
     const copyDir = path.dirname(path.dirname(serverPath));
@@ -363,7 +414,7 @@ export async function checkAndRecordHealth({ projectDir, stateRoot, configDir, n
   const mode = executionMode(env).mode;
   const install = await readRegisteredInstall({ projectDir });
   const result = await runHealthChecks({ now, mode, armySummary, agentsError, jobsRoot: path.join(stateRoot, "jobs"), pidAlive,
-    agents, openclawConfig: readOpenclawConfig(), vendors: SUBSCRIPTION_VENDORS, modelsInUse, autoPruned, usageSnapshots: readUsageSnapshots(stateRoot), install });
+    agents, openclawConfig: readOpenclawConfig(), vendors: SUBSCRIPTION_VENDORS, modelsInUse, autoPruned, usageSnapshots: readUsageSnapshots(stateRoot), stateRoot, install });
   try {
     const { loadJobRecords, agentLookup } = await import("./stats.mjs");
     const { recentSuggestions } = await import("./suggestions.mjs");

package/lib/openclaw-runtime-health.mjs

@@ -0,0 +1,56 @@
+// Metadata-only checks for the runtime used by nomArmy's real test calls.
+import { agentProviderId } from "./agents.mjs";
+export const CODEX_IMPORT_RECOVERY = "openclaw migrate apply codex --from ~/.codex --agent main --include-secrets --item auth:openai --yes";
+export function codexImportRecovery({ profiles = [] } = {}) {
+  return [...emailOpenaiProfiles(profiles).map((p) => `openclaw models auth logout ${shellId(p.id)}`), CODEX_IMPORT_RECOVERY].join(" && ");
+}
+
+export const CODEX_IMPORT_ARGS = ["migrate", "apply", "codex", "--from", "~/.codex", "--agent", "main", "--include-secrets", "--item", "auth:openai", "--yes"];
+export function emailOpenaiProfiles(profiles) {
+  return profiles.filter((p) => /^openai:.*@/.test(p.id ?? ""));
+}
+export function shellId(id) {
+  return /^[\w@.+:-]+$/.test(id) ? id : "'" + id.replaceAll("'", "'\\''") + "'";
+}
+export function usableCodexImport(profiles, now = Date.now()) {
+  return profiles.some((p) => p.provider === "openai" && /^openai:account-/.test(p.id ?? "") &&
+    [p.label, p.name, p.displayName].some((s) => typeof s === "string" && s.includes("(Codex import)")) &&
+    (p.expiresAt == null || Date.parse(p.expiresAt) > now));
+}
+export function codexImportIssues(profiles, { now = Date.now() } = {}) {
+  const issues = [];
+  const emails = emailOpenaiProfiles(profiles);
+  const fix = codexImportRecovery({ profiles });
+  if (!usableCodexImport(profiles, now)) issues.push({
+    id: "codex-import:missing", severity: "error", title: "Codex has no unexpired account-ID (Codex import) profile",
+    detail: "The Codex app-server cannot use an email-keyed OpenAI login. Confirm Codex CLI login, then re-import it.",
+    fix, short: "Codex import missing",
+  });
+  if (emails.length) issues.push({
+    id: "codex-import:shadowed", severity: "error", title: "Email-keyed OpenAI profiles capture the Codex import",
+    detail: `Remove before importing: ${emails.map((p) => p.id).join(", ")}. A models status probe is not an app-server login test.`,
+    fix, short: "Codex import shadowed",
+  });
+  return issues;
+}
+export function modelPolicyIssues({ policies, paths, agents = {}, armySummary = null, modelsInUse = null }) {
+  const models = new Set(modelsInUse ?? []);
+  for (const a of Object.values(agents ?? {})) {
+    const provider = agentProviderId(a);
+    if (provider && a.model && a.model !== "auto") models.add(`${provider}/${a.model}`);
+  }
+  for (const role of Object.values(armySummary?.roles ?? {})) {
+    const provider = agentProviderId(agents?.[role.agent]);
+    if (provider && role.model && role.model !== "auto" && !role.modelIsAuto) models.add(`${provider}/${role.model}`);
+  }
+  return policies.flatMap((result, i) => {
+    let allow;
+    try { allow = result.ok ? JSON.parse(result.stdout) : null; } catch { return []; }
+    if (!Array.isArray(allow)) return [];
+    const missing = [...models].filter((m) => !allow.includes(m)).sort();
+    if (!missing.length) return [];
+    return [{ id: `model-policy:${paths[i]}`, severity: "error", title: `OpenClaw model policy excludes: ${missing.join(", ")}`,
+      detail: `${paths[i]} refuses models used by nomArmy agents or roles.`,
+      fix: `openclaw config unset ${paths[i].replace(/\.allow$/, "")} (or add the missing models to ${paths[i]})`, short: "models blocked" }];
+  });
+}

package/lib/statusline.mjs

@@ -50,12 +50,12 @@ export function statusLineText({ session = {}, stateRoot, now = Date.now(), maxL
   const root = stateRoot ?? (process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents"));
   // Every Claude Code window redraws this line with its own last-seen
   // limits, idle ones included, so a reading is merged rather than trusted
-  // (mergeUsageSnapshot), and written only when it moves the figure.
+  // (mergeUsageSnapshot). Unchanged observations refresh on a bounded interval.
   try {
     const snapshot = normalizeClaudeRateLimits(session.rate_limits);
     if (snapshot) {
       const previous = readUsageSnapshots(root)["claude-cli"];
-      const merged = mergeUsageSnapshot(previous, { ...snapshot, observedAt: now }, now);
+      const merged = mergeUsageSnapshot(previous, { ...snapshot, sourceId: session.session_id, observedAt: now }, now);
       if (merged !== previous) recordUsageSnapshot(root, "claude-cli", merged);
     }
   } catch { /* usage capture must never break the status line */ }

package/lib/subscription-setup.mjs

@@ -187,6 +187,19 @@ export function probeOutcome({ stdout = "", stderr = "" } = {}) {
   return { ok: false, reason: message ? message.replace(/\\"/g, '"').slice(0, 300) : null };
 }
 
+/**
+ * A probe answer that means the login itself failed, not the model.
+ * 401, a missing bearer, no usable profiles, or an unavailable selected
+ * profile are sign-in failures. A refusal, rate limit, or timeout is not.
+ */
+export function openclawSignInFailure(text) {
+  const s = String(text ?? "");
+  return /\b401\b/.test(s)
+    || /missing bearer/i.test(s)
+    || /no usable profiles/i.test(s)
+    || /selected auth profile\b[^]{0,240}?\bis unavailable/i.test(s);
+}
+
 /**
  * Muse Code's non-secret login descriptor (~/.config/muse/auth.json) ->
  * { loggedIn, email }. Reads only descriptor fields; the credential itself

package/lib/usage-limits.mjs

@@ -1,3 +1,5 @@
+import { execFile } from "node:child_process";
+import { isDeepStrictEqual, stripVTControlCharacters } from "node:util";
 import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
@@ -7,10 +9,25 @@ import { randomUUID } from "node:crypto";
 // passes them to the status line. Kept per OpenClaw provider id (one host
 // login per provider) in <stateRoot>/usage-limits.json. Admission holds a job
 // on an agent that's over its limit until the General confirms.
+//
+// Those readings only update when a job finishes. A reading taken before a
+// reset, or before the operator bought more usage, would then hold every
+// job, and the reading would never refresh. A reading older than a few
+// minutes is refreshed from `openclaw models status` before that hold, and
+// again when health or the army/capacity views show it. The refresh is
+// async: spawnSync would freeze the server's event loop.
 
 const object = value => value !== null && typeof value === "object" && !Array.isArray(value);
 const finite = value => typeof value === "number" && Number.isFinite(value);
 const windowName = minutes => ({ 300: "5h", 10080: "week", 1440: "day" })[minutes] ?? `${minutes}m`;
+const USAGE_SOURCES = ["codex", "claude", "openclaw"];
+// Older than this, an over-limit reading is refreshed before it holds a job.
+export const USAGE_STALE_MINUTES = 10;
+// Source observations age out independently, even when the reset stays the same.
+export const CLAUDE_USAGE_SOURCE_TTL_MS = 30 * 60 * 1000;
+const CLAUDE_USAGE_SOURCE_REFRESH_MS = 5 * 60 * 1000;
+export const USAGE_REFRESH_TIMEOUT_MS = 20000;
+const RESET_UNIT_MS = { d: 86400000, h: 3600000, m: 60000, s: 1000 };
 function window(value, name, minutes, percentKey) {
   if (!object(value) || !finite(value[percentKey]) || value[percentKey] < 0) return null;
   return { name, usedPercent: value[percentKey], windowMinutes: minutes,
@@ -65,38 +82,59 @@ export function normalizeClaudeRateLimits(rateLimits) {
   return windows.length ? { source: "claude", plan: null, limitReached: false, observedAt: Date.now(), windows } : null;
 }
 
+/** Maximum of the recent sources for one reset window. */
+function recentUsageWindow(w, observedAt, now, sourceTtlMs) {
+  if (w.resetsAt !== null && w.resetsAt <= now) return null;
+  const sources = (w.sources ?? [{ usedPercent: w.usedPercent, observedAt }])
+    .filter(s => now - s.observedAt <= sourceTtlMs);
+  if (!sources.length) return null;
+  return { ...w, usedPercent: Math.max(...sources.map(s => s.usedPercent)), sources };
+}
+
 /**
- * Combine a stored snapshot with a new reading that may be stale. Every
- * Claude Code window passes the status line the limits from its own last
- * response, so an idle window keeps reporting an old, lower figure. Usage
- * only rises within a window, so per window: a later reset wins, and at the
- * same reset the higher figure wins. A stored window the reading lacks is
- * kept while it's live. Returns the stored snapshot itself when nothing
- * changed, so callers can skip the write.
+ * Keep the latest observation per source and window. At the same reset,
+ * recent sources compete by percentage; a later reset replaces all sources
+ * for the earlier reset. Legacy snapshots count as one source at observedAt.
+ * Anonymous readings each get their own source. Unchanged redraws refresh
+ * source timestamps at most once every five minutes, before sources expire.
  */
-export function mergeUsageSnapshot(previous, incoming, now = Date.now()) {
-  if (!previous) return incoming;
-  const key = (w) => [w.resetsAt ?? 0, w.usedPercent];
-  const newer = (a, b) => { const [ra, pa] = key(a), [rb, pb] = key(b); return ra > rb || (ra === rb && pa > pb); };
-  const byName = new Map(previous.windows.filter((w) => w.resetsAt === null || w.resetsAt > now).map((w) => [w.name, w]));
-  let changed = byName.size !== previous.windows.length;
+export function mergeUsageSnapshot(previous, incoming, now = Date.now(), sourceTtlMs = CLAUDE_USAGE_SOURCE_TTL_MS) {
+  const sourceId = typeof incoming.sourceId === "string" && incoming.sourceId ? incoming.sourceId : randomUUID();
+  const legacyId = previous?.sourceId ?? randomUUID();
+  const byName = new Map((previous?.windows ?? [])
+    .filter(w => w.resetsAt === null || w.resetsAt > now)
+    .map(w => [w.name, { ...w, sources: w.sources ?? [{ sourceId: legacyId, observedAt: previous.observedAt, usedPercent: w.usedPercent }] }]));
   for (const w of incoming.windows) {
+    if (w.resetsAt !== null && w.resetsAt <= now) continue;
     const stored = byName.get(w.name);
-    if (!stored || newer(w, stored)) { byName.set(w.name, w); changed = true; }
+    if (stored && (stored.resetsAt ?? 0) > (w.resetsAt ?? 0)) continue;
+    const sources = stored && stored.resetsAt === w.resetsAt ? stored.sources : [];
+    const last = sources.find(s => s.sourceId === sourceId);
+    if (last && last.observedAt > incoming.observedAt) continue;
+    if (last && last.usedPercent === w.usedPercent && stored.windowMinutes === w.windowMinutes
+      && incoming.observedAt - last.observedAt < Math.min(CLAUDE_USAGE_SOURCE_REFRESH_MS, sourceTtlMs / 2)) continue;
+    byName.set(w.name, { ...w, sources: [
+      ...sources.filter(s => s.sourceId !== sourceId),
+      { sourceId, observedAt: incoming.observedAt, usedPercent: w.usedPercent },
+    ] });
   }
-  const limitReached = incoming.limitReached || previous.limitReached;
-  if (!changed && limitReached === previous.limitReached) return previous;
-  return { ...incoming, limitReached, observedAt: now, windows: [...byName.values()] };
+  const windows = [...byName.values()].map(w => recentUsageWindow(w, incoming.observedAt, now, sourceTtlMs)).filter(Boolean);
+  const { sourceId: ignored, ...snapshot } = incoming;
+  const merged = { ...snapshot, limitReached: incoming.limitReached || Boolean(previous?.limitReached), observedAt: now, windows };
+  // Keep identity for callers that avoid writes when only the redraw time changed.
+  return previous && isDeepStrictEqual({ ...merged, observedAt: previous.observedAt }, previous) ? previous : merged;
 }
 
 export function readUsageSnapshots(stateRoot) {
   try {
     const data = JSON.parse(fs.readFileSync(path.join(stateRoot, "usage-limits.json"), "utf8"));
     if (!object(data)) return {};
-    return Object.fromEntries(Object.entries(data).filter(([, s]) => object(s) && ["codex", "claude"].includes(s.source)
+    return Object.fromEntries(Object.entries(data).filter(([, s]) => object(s) && USAGE_SOURCES.includes(s.source)
       && finite(s.observedAt) && typeof s.limitReached === "boolean" && (s.plan === null || typeof s.plan === "string")
       && Array.isArray(s.windows) && s.windows.every(w => object(w) && typeof w.name === "string" && finite(w.usedPercent)
-        && (w.windowMinutes === null || finite(w.windowMinutes)) && (w.resetsAt === null || finite(w.resetsAt)))));
+        && (w.windowMinutes === null || finite(w.windowMinutes)) && (w.resetsAt === null || finite(w.resetsAt))
+        && (w.sources === undefined || (Array.isArray(w.sources) && w.sources.every(s => object(s)
+          && typeof s.sourceId === "string" && finite(s.observedAt) && finite(s.usedPercent) && s.usedPercent >= 0))))));
   } catch { return {}; }
 }
 
@@ -113,8 +151,11 @@ export function recordUsageSnapshot(stateRoot, provider, snapshot) {
   } finally { fs.rmSync(tmp, { force: true }); }
 }
 
-export function usageStatus(snapshot, now = Date.now()) {
-  const live = snapshot.windows.filter(w => w.resetsAt === null || w.resetsAt > now).sort((a, b) => b.usedPercent - a.usedPercent);
+export function usageStatus(snapshot, now = Date.now(), sourceTtlMs = CLAUDE_USAGE_SOURCE_TTL_MS) {
+  const windows = snapshot.source === "claude"
+    ? snapshot.windows.map(w => recentUsageWindow(w, snapshot.observedAt, now, sourceTtlMs)).filter(Boolean)
+    : snapshot.windows;
+  const live = windows.filter(w => w.resetsAt === null || w.resetsAt > now).sort((a, b) => b.usedPercent - a.usedPercent);
   const reached = snapshot.limitReached && (snapshot.windows.length === 0 || live.length > 0);
   const highest = live[0];
   const level = reached || highest?.usedPercent >= 100 ? "over" : highest?.usedPercent >= 80 ? "high" : "ok";
@@ -124,3 +165,165 @@ export function usageStatus(snapshot, now = Date.now()) {
   return { level, text, short, resetsAt: level === "over" ? highest?.resetsAt ?? null : null,
     ageMinutes: Math.max(0, Math.floor((now - snapshot.observedAt) / 60000)) };
 }
+
+/** An over-limit reading old enough that the window may already have reset. */
+export function usageReadingIsStale(status) {
+  return status?.level === "over" && status.ageMinutes >= USAGE_STALE_MINUTES;
+}
+
+/** View text. A stale over-limit reading is marked; a fresh one is unchanged. */
+export function usageDisplayText(status) {
+  if (!usageReadingIsStale(status)) return status.text;
+  return `${status.text}; possibly stale (${status.ageMinutes} minutes old)`;
+}
+
+export function staleUsageRefreshedNote(provider) {
+  return `stale usage reading for ${provider} was refreshed from OpenClaw`;
+}
+
+function refreshFailureMessage(error) {
+  const message = String(error?.message ?? error ?? "");
+  return /timed out|timeout/i.test(message) ? "OpenClaw usage refresh failed (timed out)" : "OpenClaw usage refresh failed";
+}
+
+function withTimeout(promise, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("OpenClaw usage refresh timed out")), timeoutMs);
+    Promise.resolve(promise).then(
+      (value) => { clearTimeout(timer); resolve(value); },
+      (error) => { clearTimeout(timer); reject(error); },
+    );
+  });
+}
+
+/** Async `openclaw` runner. Never spawnSync: that blocks every other request. */
+export function runOpenClawStatus(cmd, args, { timeoutMs = USAGE_REFRESH_TIMEOUT_MS } = {}) {
+  return new Promise((resolve) => {
+    execFile(cmd, args, { encoding: "utf8", timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024, windowsHide: true }, (error, stdout) => {
+      resolve({ ok: !error, stdout: stdout ?? "", error: error ? String(error.message ?? error) : null });
+    });
+  });
+}
+
+function windowFromLabel(label) {
+  const text = String(label ?? "").trim();
+  const hours = /^(\d+(?:\.\d+)?)h$/i.exec(text);
+  if (hours) {
+    const minutes = Math.round(Number(hours[1]) * 60);
+    return { name: windowName(minutes), windowMinutes: minutes };
+  }
+  const days = /^(\d+(?:\.\d+)?)d$/i.exec(text);
+  if (days) {
+    const minutes = Math.round(Number(days[1]) * 1440);
+    return { name: windowName(minutes), windowMinutes: minutes };
+  }
+  const mins = /^(\d+(?:\.\d+)?)m$/i.exec(text);
+  if (mins) {
+    const minutes = Math.round(Number(mins[1]));
+    return { name: windowName(minutes), windowMinutes: minutes };
+  }
+  const named = { week: 10080, day: 1440, "5h": 300, spend: null };
+  if (Object.hasOwn(named, text)) return { name: text === "week" || text === "day" || text === "5h" ? windowName(named[text]) : text, windowMinutes: named[text] };
+  return { name: text || "unknown", windowMinutes: null };
+}
+
+function resetAtFromDelay(delay, now) {
+  if (delay == null || delay === "") return null;
+  if (typeof delay === "number" && Number.isFinite(delay)) {
+    if (delay > 1e12) return delay;
+    if (delay > 1e9) return delay * 1000;
+    return null;
+  }
+  const text = String(delay).trim();
+  if (!text) return null;
+  if (/^\d{4}-\d{2}-\d{2}/.test(text)) {
+    const iso = Date.parse(text);
+    return Number.isFinite(iso) ? iso : null;
+  }
+  let ms = 0, matched = false;
+  for (const part of text.matchAll(/(\d+(?:\.\d+)?)\s*([dhms])/gi)) {
+    matched = true;
+    ms += Number(part[1]) * RESET_UNIT_MS[part[2].toLowerCase()];
+  }
+  return matched ? now + ms : null;
+}
+
+function snapshotFromWindows(windows, now) {
+  if (!windows.length) return null;
+  return { source: "openclaw", plan: null, limitReached: false, observedAt: now, windows };
+}
+
+function parseUsageRemainder(remainder, now) {
+  const windows = [];
+  const re = /(\S+)\s+(\d+(?:\.\d+)?)%\s+left(?:\s*⏱\uFE0F?\s*((?:\d+(?:\.\d+)?\s*[dhms]\s*)+))?/gi;
+  for (const match of String(remainder).matchAll(re)) {
+    const built = windowFromLabel(match[1]);
+    const usedPercent = 100 - Number(match[2]);
+    if (!Number.isFinite(usedPercent) || usedPercent < 0) continue;
+    windows.push({ name: built.name, usedPercent, windowMinutes: built.windowMinutes, resetsAt: resetAtFromDelay(match[3] ?? null, now) });
+  }
+  return windows;
+}
+
+function parseTextUsage(raw, now) {
+  const out = {};
+  const lineRe = /(?:^|[\n"\s\u2500-\u257f])([A-Za-z0-9._-]+)\s+usage:\s+([^"\n]+)/g;
+  for (const line of String(raw).matchAll(lineRe)) {
+    const snapshot = snapshotFromWindows(parseUsageRemainder(line[2], now), now);
+    if (snapshot) out[line[1]] = snapshot;
+  }
+  return out;
+}
+
+/**
+ * OpenClaw usage from plain-text `models status`:
+ * `- <provider> usage: <window> <N>% left ⏱<duration>`.
+ * "N% left" becomes used percent (100 - N). Returns provider -> snapshot.
+ * The JSON status output does not include usage readings.
+ */
+export function parseOpenClawUsageOutput(raw, now = Date.now()) {
+  return parseTextUsage(stripVTControlCharacters(String(raw ?? "")), now);
+}
+
+/** Ask OpenClaw for current usage without blocking the event loop. */
+export async function fetchOpenClawUsage({ run = runOpenClawStatus, now = Date.now(), timeoutMs = USAGE_REFRESH_TIMEOUT_MS, openclawCmd = process.env.NOMARMY_OPENCLAW_CMD || "openclaw" } = {}) {
+  const failure = (error) => ({ ok: false, snapshots: {}, error: refreshFailureMessage(error) });
+  try {
+    return await withTimeout((async () => {
+      const result = await run(openclawCmd, ["models", "status"], { timeoutMs });
+      // Partial stdout from a failed command is not a fresh usage reading.
+      if (!result?.ok) return failure(result?.error);
+      const snapshots = parseOpenClawUsageOutput(result.stdout, now);
+      return Object.keys(snapshots).length ? { ok: true, snapshots, error: null } : failure(null);
+    })(), timeoutMs);
+  } catch (error) { return failure(error); }
+}
+
+/**
+ * Refresh over-limit readings older than USAGE_STALE_MINUTES. No OpenClaw
+ * call when nothing is stale. A failed refresh leaves the stored readings
+ * and says so. `snapshots` lets a caller pass what it already read.
+ */
+export async function refreshStaleOverLimitReadings(stateRoot, { run, now = Date.now(), snapshots = null, timeoutMs = USAGE_REFRESH_TIMEOUT_MS, openclawCmd } = {}) {
+  const current = snapshots ?? (stateRoot ? readUsageSnapshots(stateRoot) : {});
+  const stale = Object.entries(current).filter(([, snapshot]) => usageReadingIsStale(usageStatus(snapshot, now))).map(([provider]) => provider);
+  if (!stale.length) return { called: false, ok: true, snapshots: current, error: null, failedProviders: [] };
+  let fetched;
+  try { fetched = await fetchOpenClawUsage({ run, now, timeoutMs, openclawCmd }); }
+  catch (error) { return { called: true, ok: false, snapshots: current, error: refreshFailureMessage(error), failedProviders: stale }; }
+  if (!fetched.ok) return { called: true, ok: false, snapshots: current, error: fetched.error ?? "OpenClaw usage refresh failed", failedProviders: stale };
+  const updated = { ...current };
+  const seen = new Set();
+  for (const provider of stale) {
+    const snapshot = fetched.snapshots[provider];
+    if (!snapshot) continue;
+    try {
+      if (stateRoot) recordUsageSnapshot(stateRoot, provider, snapshot);
+      // A job may have saved a newer observation while the refresh was pending.
+      updated[provider] = stateRoot ? readUsageSnapshots(stateRoot)[provider] ?? snapshot : snapshot;
+      seen.add(provider);
+    } catch { /* Keep the hold if the fresh snapshot could not be recorded. */ }
+  }
+  const failedProviders = stale.filter((provider) => !seen.has(provider));
+  return { called: true, ok: failedProviders.length === 0, snapshots: updated, error: failedProviders.length ? "OpenClaw usage refresh failed" : null, failedProviders };
+}

package/mcp/server.mjs

@@ -32,7 +32,7 @@ import { liveLeases } from "../lib/slots.mjs";
 import { createRun, loadRun, runTotals, finishRun, resolveRunLimits, describeLoweredLimits } from "../lib/runs.mjs";
 import { agentDispatchFields, resolveAgentModel, agentProviderId, describeAgent } from "../lib/agents.mjs";
 import { OUTCOMES, COORDINATOR_STATUS_BY_OUTCOME } from "../lib/outcomes.mjs";
-import { readUsageSnapshots, usageStatus } from "../lib/usage-limits.mjs";
+import { readUsageSnapshots, usageStatus, usageDisplayText, refreshStaleOverLimitReadings } from "../lib/usage-limits.mjs";
 import { modelRefusals } from "../lib/health.mjs";
 import { retryRefusedModelsInBackground } from "../lib/refusal-retry.mjs";
 import { podmanProblem, podmanVmStartedAt } from "../lib/podman-health.mjs";
@@ -307,7 +307,7 @@ const { executeJob, executeImplement, executeScout, executeDecompose } = createE
 });
 export { executeJob };
 
-const { WORKER_START_STAGGER_MS, activeJobs, runningCount, agentMaxConcurrent, withAgentSlot, track, notifyJobFinished, capacitySnapshot, admit, refusal, runBrief, recordJobInRun, trackInRun, launch, liveProgress, summarize } = createJobRuntime({
+const { WORKER_START_STAGGER_MS, activeJobs, runningCount, agentMaxConcurrent, withAgentSlot, track, notifyJobFinished, capacitySnapshot, displayedCapacity, admit, refusal, runBrief, recordJobInRun, trackInRun, launch, liveProgress, summarize } = createJobRuntime({
   projectDir, stateRoot, jobsRoot, runsRoot, leasesRoot, slotsRoot, run, currentMaxWorkers, slug, agentsConfig, modelCatalogReady, budgetsForJob, resolveSubscriptionSelection, executeJob, subscriptionJobFieldProblems, repoPolicy, jobArgs,
   env: process.env, budgetState, getActiveRunId: () => activeRunId,
   sandboxProblem: () => podmanChecks?.problem() ?? null,
@@ -395,10 +395,11 @@ server.tool("local_worker", "Run one isolated local worker and wait for it. mode
     const expanded = expandJobs([rawArgs]);
     if (expanded.problems.length) return refusal(expanded.problems);
     const [args] = expanded.jobs;
-    const { problems } = await admit([args]);
+    const { problems, admission } = await admit([args]);
     if (problems.length) return refusal(problems);
     const r = await launch(args).promise;
-    return toolText(coordinatorResult(r), !r.ok);
+    const refreshed = (admission.reasons ?? []).filter((line) => line.startsWith("stale usage reading "));
+    return toolText(refreshed.length ? `${coordinatorResult(r)}\n\n${refreshed.join("\n")}` : coordinatorResult(r), !r.ok);
   });
 server.tool("local_worker_start", "Start one worker or scout in the background and return immediately with a job_id. Poll it with local_worker_status (optionally long-polling with wait_seconds). Same admission rules as local_worker: refuses under memory pressure or when NOMARMY_MAX_WORKERS jobs are already running.", jobSchema.shape,
   async rawArgs => {
@@ -494,7 +495,7 @@ server.tool("local_worker_stop", "Stop a running job's worker, for example one b
 
 server.tool("local_worker_capacity", "What this host can take right now: context per nom and the brief/report budgets derived from it, memory pressure and whether another job would be admitted, and the jobs currently running. Read-only.", {}, async () => {
   await budgetState.refresh();
-  return toolText(JSON.stringify(withRestartNotice(capacitySnapshot()), null, 2));
+  return toolText(JSON.stringify(withRestartNotice(await displayedCapacity()), null, 2));
 });
 // The only way to know what `verification`/`union_verification`/
 // `verify_regression` profile names are actually valid for this repo used to
@@ -577,8 +578,9 @@ server.tool("run_finish", "Close a /feature run as complete or stopped, with a o
 server.tool("army", "Who you, the General, are and who you call for what in this repository: your fixed charter and the agent you're defined as, the army's workflow, then each role's description, phase (build, review, acceptance), suggested mode, and the agent it runs on, with which config layer set each value (global, project .nomarmy.yml, local .nomarmy.local.yml). Flags roles with no usable agent, and roles that share your model or subscription (not an independent review). Dispatch a role with `army_role`, or an agent directly with `agent`. Read-only, re-read on every call.", {}, async () => {
   try {
     const agents = agentsConfig().agents;
-    const usageSnapshots = readUsageSnapshots(stateRoot);
-    const summary = describeArmy(currentArmy(), { agents, describeAgent, usageSnapshots, agentProviderId });
+    const usageRefresh = await refreshStaleOverLimitReadings(stateRoot);
+    const usageSnapshots = usageRefresh.snapshots;
+    const summary = describeArmy(currentArmy(), { agents, describeAgent, usageSnapshots, agentProviderId, usageRefreshError: usageRefresh.error, usageRefreshFailed: usageRefresh.failedProviders });
     // Each agent's models, from OpenClaw's catalog, so the General can pick
     // one for a role set to "auto". The catalog can lag a brand-new model.
     const catalog = await modelCatalogReady();
@@ -592,7 +594,11 @@ server.tool("army", "Who you, the General, are and who you call for what in this
       const models = listed.filter((m) => !refusals[`${provider}/${m}`]);
       const refusedModels = listed.filter((m) => refusals[`${provider}/${m}`]);
       const snapshot = usageSnapshots[provider];
-      const usage = snapshot ? (() => { const { level, text } = usageStatus(snapshot); return { level, text }; })() : null;
+      const usage = snapshot ? (() => {
+        const status = usageStatus(snapshot);
+        const failed = usageRefresh.failedProviders.includes(provider);
+        return { level: status.level, text: `${usageDisplayText(status)}${failed ? `. ${usageRefresh.error}` : ""}` };
+      })() : null;
       return [name, { runsOn: describeAgent(agent), defaultModel: agent.model ?? null, models, ...(refusedModels.length ? { refusedModels } : {}), usage }];
     }));
     // A pinned model missing from the catalog isn't necessarily wrong:
@@ -632,7 +638,7 @@ server.tool("local_workers", "Run independent jobs (implement or scout) with bou
   const expanded = expandJobs(rawJobs);
   if (expanded.problems.length) return refusal(expanded.problems);
   const { jobs } = expanded;
-  const { problems } = await admit(jobs);
+  const { problems, admission } = await admit(jobs);
   let forcedBase = null;
   if (auto_union) {
     const refs = [...new Set(jobs.map(j => j.base_ref).filter(Boolean))];
@@ -697,7 +703,8 @@ server.tool("local_workers", "Run independent jobs (implement or scout) with bou
     jobs: results.map(r => ({ jobId: r.manifest.jobId, workerId: r.manifest.workerId, mode: r.manifest.mode, outcome: r.manifest.outcome || OUTCOMES.WORKER_FAILED, recovered: Boolean(r.manifest.recovered), status: r.manifest.coordinatorStatus || "failed", branch: r.manifest.branch, commit: r.manifest.commit?.sha || null, worktree: r.manifest.worktree, jobDir: r.jobDir })),
     ...(union ? { union } : {}) };
   const unionSection = union ? `UNION\n\n${formatUnion(withWindowsPaths(union))}\n\n` : "";
-  const text = `BATCH EXECUTION RECORD\n${coordinatorJson(summary)}\n\n${unionSection}WORKER RESULTS\n\n${results.map((r, i) => `===== WORKER ${i + 1} =====\n${coordinatorResult(r)}`).join("\n\n")}`;
+  const refreshed = (admission?.reasons ?? []).filter((line) => line.startsWith("stale usage reading "));
+  const text = `BATCH EXECUTION RECORD\n${coordinatorJson(summary)}\n\n${unionSection}WORKER RESULTS\n\n${results.map((r, i) => `===== WORKER ${i + 1} =====\n${coordinatorResult(r)}`).join("\n\n")}${refreshed.length ? `\n\n${refreshed.join("\n")}` : ""}`;
   return toolText(text, results.some(r => !r.ok) || union?.status === "union_verification_failed" || union?.status === "union_error");
 });
 // No model, no sandbox, no tokens spent on a worker: the coordinator asks the

package/package.json

@@ -3,7 +3,7 @@
   "description": "Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.20",
+  "version": "0.1.0-alpha.21",
   "private": false,
   "type": "module",
   "engines": {