Add quota step-down profiles with per-session approval

[merefield]

Quota thresholds should offer reviewed changes to individual Codex sessions without silently changing newly opened sessions or repeatedly requesting approval when the settings already match.

Adds repeatable --quota-step-down PERCENT:MODEL:EFFORT[:SPEED] profiles and separate profile controls beside the existing quota-reset controls. Users can review one session, skip it, or explicitly review all listed sessions when the review fits the pane.

Approved changes persist after Codexometer exits, crashes, restarts, or observes a new quota window. There is no settings history or automatic rollback. On launch and refresh, live session settings are compared with the eligible target: matching sessions need neither approval nor an update. Omitted speed accepts any current tier; standard requires an unset explicit tier; speed names are resolved through the model catalogue before comparison. Other sessions still require explicit approval. Skips and attempted-change tracking are process-local.

Confirmations are bound to reviewed targets and settings, stale quota snapshots and changed settings are rejected, and models/efforts/speeds are validated against the advertised catalogue. Slow is not assumed to mean Flex. A queued RPC acknowledgement alone is not reported as a verified change. Shutdown cancels/drains outstanding work and rejects later writes without sending restoration calls; already queued changes may still apply.

Validation:

• go test ./... passed.
• go vet ./... passed.
• Focused quota regression tests passed under the race detector.
• Tests cover restart matching without approval history, model/reasoning/speed mismatches, speed aliases, omitted/standard speed, per-session approval, stale confirmations, window changes, and control layout/click geometry.
• Unix socket integration tests are included but skipped in this environment because socket listeners are blocked; these still need an unrestricted runner and live Codex validation.

Uses experimental shared app-server session controls. Persistence across a Codex/app-server restart is controlled by Codex itself. Updates are not atomic with concurrent settings changes in the Codex UI. The feature does not edit global Codex defaults or config.toml.

[Copilot]

🟡 Changes recommended

Valid default-only model efforts are rejected, and the approval UI has misleading state and untranslated text.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds opt-in quota-triggered session profiles with explicit per-session approval and verified app-server updates.

Changes:

• Adds repeatable quota step-down CLI profiles.
• Implements terminal review, confirmation, skip, and reset-independent controls.
• Adds app-server validation, persistence behavior, shutdown handling, and tests.

File summaries

File	Description
README.md	Documents profiles and approval behavior.
main.go	Parses profiles and wires lifecycle handling.
main_test.go	Tests profile flag parsing.
internal/ui/view.go	Renders profile notices.
internal/ui/quota_step_down.go	Implements profile review controls.
internal/ui/quota_step_down_test.go	Tests approval and layout flows.
internal/ui/quota_reset.go	Integrates profile and reset controls.
internal/ui/model.go	Manages profile state and events.
internal/codex/session_settings_unix.go	Reads, validates, applies, and verifies settings.
internal/codex/session_settings_unix_test.go	Tests Unix app-server integration.
internal/codex/quota_step.go	Defines profile APIs and matching.
internal/codex/quota_step_test.go	Tests target matching.
internal/codex/daemon_status_unix.go	Adds settings-controller synchronization.
internal/codex/client.go	Stores configured quota profiles.

Review details

Suppressed comments (1)

internal/ui/quota_step_down.go:321

• After either review action, both controls are relabeled as confirmations. For example, after G arms one session, A says “CONFIRM ALL” but actually replaces that confirmation with an all-session review and requires another press. Relabel only the action identified by confirmAll; leave the other action as “REVIEW”.

	if len(m.quota.confirm) > 0 {
		labels[0] = "[G: CONFIRM ONE]"
		labels[1] = "[A: CONFIRM ALL]"
	}

• Files reviewed: 14/14 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.