[ege-arhan]

Summary

Builds on feature/auto-session-recovery and the merged recovery contributions.

• Add native Claude Code account import/login, quota cards and a visible auto-switch toggle. Credentials remain isolated in native storage; projects, settings and skills are shared.

• Resume managed Claude Code terminals after rate-limit failures only on accounts with fresh verified quota across all reported windows. Renew expiring credentials through the installed CLI.

• Add manual macOS Claude Desktop profile switching with graceful shutdown, identity matching, same-volume moves, journal recovery and overwrite protection. Code and Desktop sign-ins remain separate.

• Reuse Codex usage bars in a separate Claude-colored section. Open managed Code terminals directly; keep optional project selection as a separate remembered preference.

• Add persistent Turkish/English selection in Settings and the settings menu. Translate product UI, date/number/usage formatting, notifications, native app menus and tray controls. Provider diagnostics and release-note bodies retain their original text.

• Replace the Safari-specific action with browser-neutral open/copy links and manual completion from a final callback URL or complete code#state. Validate against the pending flow and original redirect URI; pass it to native CLI stdin, never log or persist it. Success still requires native exit and account identity verification.

• Add manual and automatic Claude warm-up using one minimal Haiku request, no tools/MCP/hooks/session persistence. Skip active/exhausted/unknown windows; serialize requests and back off after failures.

• Harden Codex recovery with single-flight checks, bounded lookups, backoff, error-time cascade prevention, launch retries and preferred model/effort handling.

• Start recovered Desktop turns through the installed Desktop owner IPC, preserving thread settings and avoiding a competing temporary writer. Report missing-owner or delivery errors without resending an ambiguous start.

• Simplify the desktop UI with provider navigation, compact account rows, visible automation and progressive advanced controls. Add seven persistent themes: macOS (default), Windows XP, Windows 7, Terminal, Paper, Nord and Mono; theme selection also synchronizes to the tray.

Naming proposal

Consider AI Account Switcher now that the application manages both Codex and Claude. This is a proposal for maintainer discussion only: this PR preserves the existing application name, bundle identifier, storage paths and update channel.

Verification

• Rust library tests: 98 passed, 1 ignored, 0 failed.
• Language preference, placeholders, native messages and theme persistence/compatibility tests: 6 passed.
• Frontend/typecheck and local macOS app bundle build passed (updater artifacts disabled; no release signing key).
• Read-only native Claude plan and cross-review completed; findings addressed.
• Installed macOS UI verified in both languages, including Settings, both provider quota cards, dates and native menus. Turkish selection and Claude auto-switch/warm-up are persisted.
• Real native Claude Haiku warm-up succeeded and its completion timestamp/live usage were saved.
• Two real Claude Code logins and live usage verified. Desktop sign-in/profile switching confirmed by the user, and the signed-in native Desktop UI inspected.
• A real Codex quota switch and continuation was observed before the owner-IPC follow-up. The new owner IPC has a protocol/ambiguous-delivery regression test and a read-only installed-Desktop handshake; a real exhausted turn has not been forced. Managed Claude Code launch was verified without a directory chooser.
• All seven themes selected in the installed macOS application; native screenshots captured for both provider views and the settings gallery. macOS/Turkish preferences persisted after restart. Static design detector returned no findings. The independent finish reviewer scored all four requested fixes resolved; native Claude frontend cross-review found no blocking issue, and its additional provider-button note was fixed. DESIGN.md records the shipped system.

Scope and limitations

• Claude automatic continuation applies to terminals opened through Switcher. Externally opened Claude processes retain their own profile.
• Claude Desktop switching is manual. Cloud chats belong to their account and are not migrated or automatically continued across accounts.
• Claude's read-only usage endpoint and native refresh environment are not public stable APIs. Failures exclude an account instead of guessing quota.
• Real Claude exhaustion/continuation and long-running credential rotation have not been tested. Existing managed terminals must be reopened through the updated Switcher to use the new runner/hooks; the update preserves already running terminals. Filesystem preservation and identity paths have regression coverage.
• The new manual callback completion has parser/flow checks; a fresh real browser reauthentication has not been repeated on the working accounts.
• Claude features are local desktop-only and are not exposed by the LAN dashboard. Warm-up consumes a small amount of subscription quota. No new dependencies.

Follow-up: paid quota policy and Desktop writer ownership

• Codex auto-switch only accepts verified Plus-and-higher plan quota; Free/Go/unknown plans and exhausted candidates are excluded. Banked credits alone do not authorize switching to an exhausted account. Manual switches remain available.
• Show a waiting notification/banner and retry verified quota each minute when no account is eligible, including the current account after its limit resets.
• Claude cards show the native verified subscription plan. Auto-switch/warm-up only accept Pro/Max/Team/Enterprise with fresh quota. Managed terminals retain the failed session and recheck quota every 30 seconds while waiting; the UI shows that state.
• Replace the temporary Desktop recovery writer with the installed Desktop's owner IPC turn request, preserving thread settings. The UI's own process starts the continuation. IPC failure is reported; no competing writer fallback is launched.
• Native owner IPC is versioned and can change between Codex Desktop releases. Real quota exhaustion/reset is not artificially triggered during verification.

Follow-up: Claude usage HTTP 429

• Handle usage-endpoint throttling separately from authentication failures; 429 no longer asks the user to sign in again (TR/EN).
• Share a per-account file lock, 45-second successful-result cache and persisted Retry-After cooldown across UI, warm-up and managed runners. Use a five-minute cooldown when the server supplies no valid delay.
• Preserve quota safety: warm-up rechecks usage without the success cache; cooldown still applies, and failed post-warm-up verification leaves the account ineligible for automatic switching.
• Verified: 99 Rust tests passed (1 ignored), 7 language/theme tests passed, frontend and macOS bundle built; installed bundle verified. Both real Claude profiles returned usage successfully without reauthentication; an immediate second refresh reused both cached results. Existing user Claude processes were preserved.
• Provider-side throttling duration and actual quota exhaustion were not forced; older already-running helper processes retain their previous code until reopened.

Follow-up: unified provider controls and theme appearances

• Use one persistent provider header: privacy, usage refresh, warm-up, settings and account menu are available in the same places for Codex and Claude. Auto-switch and automatic warm-up reflect the selected provider; provider-specific capabilities stay in its menu.
• Claude now groups its selected Code account under Active account, followed by Other accounts, with its provider color. Its independent Desktop profile remains explicitly labeled.
• All seven theme identities support independent light/dark appearance choices in Settings (14 combinations), with persistent string-based selections, tray synchronization and legacy preference compatibility.
• Claude bulk warm-up skips nonpaid, stale, unverified or exhausted usage, shows a message when no verified quota is available, and continues past individual failures. The native backend still checks identity and quota before requests.
• Verified: all 22 frontend tests passed; TypeScript/frontend and macOS bundle built; installed binary matches build. Native UI confirmed all 14 appearance selections, restart persistence, both provider headers, Claude add-account routing, privacy and active/other account grouping. Layout detector returned no findings. Source review included native Claude cross-review.
• Windows/Linux bundles and full keyboard/contrast audits were not performed; live quota exhaustion was not forced.

Follow-up: shared Grok / Cursor Desktop accounts

• Add a combined Grok / Cursor provider tab with account count, active/other account cards, verified native plan name and usage/reset values. Unified subscriptions explicitly share one pool; absent percentages stay unknown. The percentage follows installed Cursor Desktop's GetCurrentPeriodUsage.totalPercentUsed, not separate invented Grok/CLI quotas.
• Support importing the current personal Cursor account, browser-neutral PKCE login links, native poll/identity verification, cancellation, usage refresh and manual Desktop account switching. Personal-only scope is explicit; selected Team accounts are rejected until scoped plan/usage support is verified.
• Preserve Cursor local project/chat/settings/device data: require Cursor and helpers closed, verify outgoing account identity, save rotated credentials under that account, recheck authentication before a transaction that changes only the known authentication keys. Unknown outgoing accounts require import first. Restore authentication and metadata on launch failure. No machine ID reset or whole-profile database copy.
• Account credentials stay in private 0600 files under the existing configuration root; tokens/verifiers do not appear in frontend responses or diagnostic errors. Native login polling retries bounded transient failures; refresh uses a per-account cache/cooldown and isolates errors.
• Desktop automatic switching/continuation and warm-up are explicitly unavailable: no supported native owner/resume bridge was verified. Grok dashboard opens in the user's browser; this does not switch its browser login.
• Verified: 105 Rust tests passed (1 ignored), all 23 frontend tests passed, frontend/TypeScript and macOS bundle built. Installed binary matches the build. Real personal Premium account imported with isMerged=true and weekly quota/reset, active card and count visible; link generation and cancellation verified without reauthentication. Cursor/Claude/Codex user processes and chats were left untouched. Native Claude cross-review found no remaining blocker after fixes; layout detector returned no findings.
• Not tested: real second-account login completion or live Desktop auth swap, Windows/Linux runtime, actual quota exhaustion. Cursor private login/usage APIs may change.

Follow-up: reliable Claude Desktop restart

• Fix a reproduced Desktop switch failure: the browser-owned chrome-native-host outlived the GUI and was incorrectly treated as an open Desktop profile writer, so switching timed out after closing the app. Inspect executable paths and wait only for the native main process and Electron helpers; exclude browser host, crashpad and standalone CLI tools.
• Preserve existing profile identity checks, private backups, transaction journal and rollback. After a failed switch, reopen the original intact profile only when this operation quit the app and no unresolved transaction remains. Check all launcher exit statuses and translate actionable launch errors.
• Verified independently: 107 Rust tests passed (1 ignored), 23 frontend tests passed, seven process-role fixtures passed; TypeScript and macOS bundle built. Installed binary hash matches. Real native UI roundtrip Mavel → Ege → Mavel switched accounts and automatically reopened Claude both times; original Desktop selection restored, Code selection unchanged, no pending transaction journal.
• Not tested: Windows/Linux runtime; genuine OS launch failures and unresolved transaction recovery were covered by tests rather than forced against live profiles.

[bnku]

Hi @ege-arhan! Thank you for the massive effort and for all your previous contributions (#1, #2, #3) to the recovery branch!

I reviewed the PR in detail. There is a lot of great engineering here (especially the Codex recovery hardening, single-flight lock, detected_at timestamp comparison, pending_launches backoff, and the Desktop owner IPC bridge).

However, we cannot merge this combined PR directly into feature/auto-session-recovery for a critical reason:
feature/auto-session-recovery is the live head branch for upstream PR Lampese/codex-switcher#192. Since Lampese#192 is already a large PR waiting for upstream maintainer review, adding +7,500 lines of unrelated features (Claude, Cursor/Grok, 7 themes, Turkish/English i18n, and .impeccable/ design artifacts) into that branch will make Lampese#192 impossible to review and merge upstream.

How to get your work into upstream effectively

To give your features the best chance of landing in Lampese/codex-switcher (without being blocked waiting on Lampese#192), I strongly recommend splitting this into focused, atomic PRs:

1. Codex Auto-Recovery Hardening (Target: bnku:feature/auto-session-recovery)

   • Scope: Only the Codex recovery improvements in src-tauri/src/commands/auto_recovery.rs (plus the minimal quota_waiting / recovery_failed event handling in lib.rs / App.tsx).
   • Please keep two things in mind so Linux/CLI workflows don't regress:
     • In terminate_process, please preserve the Linux /proc/{pid}/stat parent node wrapper check and fallback termination so hung CLI processes on Linux don't abort recovery.
     • In relaunch_cli_session, please keep the send_codex_queue_resume fallback for non-goal CLI sessions (or ensure sessions started outside the macos_resume_command wrapper still receive the continuation prompt).
     • In select_best_account, if the usage endpoint is temporarily unreachable (e.g. Cloudflare 403), RoundRobin should still be able to fall back rather than hard-stalling if possible.
   • Once scoped to just Codex recovery, I will gladly merge it into feature/auto-session-recovery so it goes upstream with feat: Auto Recovery & Session Automation (Capacity Retries, Zero-Downtime Limit Switching, and Reset Credits Auto-Redeem) Lampese/codex-switcher#192!

2. Desktop Themes (Target: Lampese/codex-switcher main directly)

   • Scope: src/lib/theme.ts, src/App.css, SettingsModal.tsx, and tests/theme.test.ts (without .impeccable/*, DESIGN.md, PRODUCT.md).
   • This doesn't depend on auto-session-recovery at all — you can branch off upstream/main and open a clean PR directly to Lampese/codex-switcher right away!

3. Interface Localization EN/TR (Target: Lampese/codex-switcher main directly)

   • Scope: language.rs and src/lib/i18n*.ts.
   • Important note for upstream: currently language.rs (TURKISH) and normalizeLanguage() default to "tr" (Turkish) when no preference is stored. For upstream acceptance, the default fallback must be "en" (English) unless "tr" is explicitly selected (or detected from the OS locale).

4. Claude & Cursor/Grok Providers (Target: Separate atomic branches + Upstream RFC Issue)

   • Adding Claude and Cursor turns Codex Switcher into a multi-provider manager (claude.rs + cursor.rs). Neither of these modules actually depends on auto_recovery.rs (claude.rs uses its own CLI runner/hook loop).
   • I recommend opening an Issue / Discussion on Lampese/codex-switcher first to propose multi-provider tabs (and your naming proposal), and keeping feature/claude-accounts and feature/cursor-accounts as separate branches off upstream/main.
   • Also, remove .impeccable/*, DESIGN.md, and PRODUCT.md from git history so the diff stays clean.

In our fork (bnku/codex-switcher), our enhanced branch is built by automatically merging atomic feature/* branches on top of upstream/main. If you split the Codex recovery hardening into a clean PR against feature/auto-session-recovery, we can merge that immediately!

[ege-arhan]

Thanks for the detailed review and for the earlier recovery collaboration. I have split this combined contribution as suggested:

1. Recovery only: fix(recovery): harden account handoff and session resume #5 targets feature/auto-session-recovery and contains only auto_recovery.rs plus minimal lib.rs / App.tsx events. Linux parent-node wrapper termination/fallback, non-goal CLI continuation and RoundRobin transient-usage fallback are preserved. Process identity checks also guard pending retries/signals against PID reuse. 37 recovery tests and frontend build passed.
2. Desktop themes: Lampese/codex-switcher#213, based directly on upstream main; all GitHub checks passed.
3. EN/TR localization: draft Lampese/codex-switcher#214, based on upstream main, English default unless Turkish is explicitly selected. It explicitly acknowledges the existing feat(i18n): add English and Simplified Chinese localization Lampese/codex-switcher#181 foundation and stays draft pending alignment. Build, 27 frontend tests and two native language tests passed (one existing platform test skipped).
4. Providers: upstream RFC #212, with independent Claude and Cursor prototype branches based on upstream main. No provider merge request is being coupled to feat: Auto Recovery & Session Automation (Capacity Retries, Zero-Downtime Limit Switching, and Reset Credits Auto-Redeem) Lampese/codex-switcher#192 before scope approval.

The new branches have no .impeccable/, DESIGN.md or PRODUCT.md history/diffs. The original personal feature branch and installed app are preserved; I did not force-rewrite history or merge any PR.

Closing this combined PR as superseded by those focused contributions. Recovery #5 is the replacement to review for this fork/branch.