[lifan-builds]

Closes #207.

When the active ChatGPT account exhausts its quota, this opt-in feature selects the next saved account with freshly confirmed capacity and reuses the existing close/switch/reopen flow.

Behavior

• Check once a minute while desktop Switcher runs. Confirm exhaustion at 100% of either usage window, allow usable credits, and skip API-key accounts or unknown/failed quota responses. Walk saved accounts in order with wraparound.
• Recheck quota and the active source before acting. Enforce the expected source under the shared native authentication lock so a queued automatic switch cannot override an intervening manual selection.
• Close and reopen supported running desktops, using graceful closing unless force close was selected. Leave unsupported processes alone. When Codex is already closed, change only the account.
• Expose monitoring/error status and a turn-off control. Use one in-flight check, 15-second read timeouts, and a five-minute cooldown after a switch/error. Pause while manual switch, Settings, or add-account dialogs are open. Disable background suspension on macOS 14+ for tray monitoring.

Validation

Checks rerun on this standalone branch on October 28, 2026, after merging current upstream main: pnpm build passed; pnpm test passed (28 passed, 1 platform-specific skip); cargo test --locked --manifest-path src-tauri/Cargo.toml -- --test-threads=1 passed (62 passed, 1 opt-in live test ignored); changed Rust formatting and git diff --check passed.

Five policy tests cover quota thresholds, credits, unknown/error results, saved-order wraparound, candidate failures, resets, source changes, cancellation, unsupported processes, and switch failures. The native race test verifies the source is checked after waiting for the authentication lock. Earlier mocked production-frontend scenarios covered close/switch/reopen ordering and failures, opt-in/off, cooldown, and source races in the combined implementation; this split reran builds and automated suites.

A full automatic switch against a real newly exhausted account has not been observed. Windows runtime and hidden-window timing outside macOS 14+ remain unverified. Enabling the feature authorizes automatic closing; unsaved Codex work can be lost, as stated in Settings.

Related contributions

Conversation recovery: #205 / #206. Direct re-login: #208 / #210. This branch targets upstream main independently and contains no recovery or fork-distribution code. When merging the features together, preserve both App/Settings changes, route automatic closing through recovery when enabled, and include the re-login dialog in the monitoring pause guard.