feat: show Codex session reset in status bar

[tank321]

Summary

Adds a compact, cached OpenAI Codex session-limit segment to the classic CLI status bar, for example Codex 44% reset 4h 38m.

The indicator makes current-session pressure visible without interrupting work to run /usage.

Behavior

• Only shown when the active runtime provider is openai-codex
• Hidden until a cached usage snapshot is available
• Shows remaining session percentage and reset countdown when available
• Shown only in the wide status-bar tier (>=76 columns)
• /usage remains the detailed synchronous view

Status-bar safety

• The render path never performs network I/O
• Usage refresh runs in a daemon thread
• Refresh attempts are limited to once every five minutes
• A lock allows only one refresh at a time
• Fetch failures keep the previous good snapshot and do not affect CLI responsiveness
• Fetch credentials and their non-secret scope come from one immutable OpenAI client snapshot
• Provider identity is checked before and after client capture, and refreshes are restricted to the native chatgpt.com Codex endpoint
• Credential failover clears stale quota data, bypasses the old rate limit, and discards in-flight results from the previous account
• Active runtime-agent credentials are preferred so provider fallbacks do not use stale CLI credentials

Changes

• cli.py: adds cached Codex usage state, nonblocking refresh, compact formatting, and wide-tier rendering
• tests/cli/test_cli_status_bar.py: covers percentage/reset formatting, invalid values, provider switching, width fallbacks, styling, single-flight refresh, rate limiting, active credentials, successful refreshes, and failure behavior

The current credential-resolution implementation in agent/account_usage.py is preserved unchanged.

Test Plan

• python -m pytest tests/cli/test_cli_status_bar.py tests/cli/test_cli_background_status_indicator.py tests/cli/test_cli_background_tui_refresh.py tests/agent/test_account_usage.py -q --tb=short -n 0 -o 'addopts='
  • 105 passed
• python -m compileall -q cli.py tests/cli/test_cli_status_bar.py
• uvx ruff check cli.py tests/cli/test_cli_status_bar.py
• git diff --check

[tank321]

Hi! I wanted to add a little more context on the UX/safety side of this change.

This is intended to make Codex session limits glanceable/actionable in the CLI status bar, similar to the existing background-task, compression, and idle-time indicators. The indicator is intentionally quiet: it is hidden unless the current provider is openai-codex and a cached usage snapshot is available.

A few implementation details to avoid status-bar risk:

• the render path never performs network IO
• usage refresh is cached and rate-limited to once every 5 minutes
• only one refresh thread can run at a time
• failures are silent and simply hide/keep the previous indicator rather than affecting CLI responsiveness
• /usage remains the detailed synchronous view

The goal is to keep this compact and actionable: users can see whether they are close to the Codex session limit and when it resets without needing to interrupt flow with /usage.

Validation included in the PR:

• python -m pytest tests/cli/test_cli_background_status_indicator.py tests/test_account_usage.py -v --tb=short -n 0 -o 'addopts='
• live smoke output showed: Codex 44% reset 4h 38m

Happy to adjust the placement/wording, add more layout coverage, or add TUI parity if that is preferred.

[teknium1]

Thanks for the focused cached-status-bar design. The feature is still absent on current main: cli.py:4549-5251 has no account-usage snapshot or Codex quota segment.

Problems

• The credential fallback in the PR is no longer safe to carry forward. Its broad except Exception can turn a transient resolver failure into a pool lookup for a different account. Current main intentionally narrows this at agent/account_usage.py:459-480; regression tests at tests/agent/test_account_usage.py:121-194 require fail-open behavior and preservation of the resolved singleton token. This hardening landed in 130e2337c.

Suggested changes

• Salvage the status-bar feature onto the current snapshot/width-tier paths in cli.py:4549-5251, but retain current _resolve_codex_usage_credentials().
• Add coverage in the current status-bar suite, tests/cli/test_cli_status_bar.py, including width fallback and refresh behavior.

This is an automated hermes-sweeper review.

[teknium1]

Do not catch every resolver/token-read failure here and then fall back to the pool: a transient resolver failure can display another pooled account's quota. Current main's agent/account_usage.py:459-480 intentionally limits pool fallback to AuthError and preserves a successfully resolved token when only the account-id read fails.

[tank321]

Updated this against current main and rebuilt the indicator on the current status-bar paths. The patch now keeps usage refreshes off the render thread, limits the segment to the wide layout, preserves the existing credential resolver, and scopes cached results to one immutable Codex client so provider or credential changes cannot display another account's quota.

The focused status-bar and account-usage suite passes locally (105 tests), along with Ruff, compile, and diff checks. The new CI run is waiting for maintainer approval: https://github.com/NousResearch/hermes-agent/actions/runs/29468566648