FEAT: shared quota profile policies for terminal and writable web sessions

[merefield]

Quota thresholds can now use the existing Sessions command centre for individual profile reviews, or apply a profile automatically when explicitly authorized at launch. Existing command lines default to ask and continue requiring approval for each session.

Behaviour

• Replace the separate Quota-page profile approval UI with QUOTA THRESHOLD session pills and sectioned current/proposed model, reasoning and speed details. Native Codex approvals/input and quota reviews can have separate pills for the same session.
• In ask mode, review one session, then apply and confirm (1, then C), or skip (2). Controls are clickable and inline buttons appear only when the complete review fits. Navigation and refreshed inventory disarm confirmations; focused or sending composers are preserved.
• Extend --quota-step-down to PERCENT:MODEL:EFFORT[:SPEED[:ask|auto]]. The final mode is optional and defaults to ask. An empty speed field preserves speed, for example 80:gpt-5.6-sol:medium::auto.
• In auto mode, apply once per eligible loaded session at the active threshold. Process sessions sequentially with fresh inventory and backend verification; new sessions follow the same policy. Already-matching sessions are considered handled. Subsequent manual overrides are respected during that quota window and process lifetime.
• Failed or uncertain attempts remain visible without automatic retries. Subsequent thresholds can apply their own policy. Tracking resets on restart or a new quota window; applied settings are never rolled back.
• Require fresh per-thread settings evidence or readback to verify writes, normalize implicit/explicit default speed, distinguish rejected from accepted-but-unverified updates, and reconcile outstanding notices when matching settings are observed.
• Rescan when a threshold changes during a write, discard expired review selections, and wrap outcome notices in narrow detail panes.
• Add the same policies to writable web Sessions. Separate quota pills open profile reviews beside native Codex requests, preserving native composers. Full-detail controls use the existing authenticated offer/prepare/commit flow; inline panes link to full review.
• Share policy selection, eligibility, attempt tracking and verified application in an interface-independent Go controller. TUI geometry, controls and interaction remain unchanged; presentation-specific confirmation and authentication remain in their adapters.
• Require --web --web-control for browser quota policies, including auto. Read-only launches reject quota-policy flags and have no control endpoints. Browser confirmations bind the current settings, threshold, window and account, and expire after 30 seconds.
• Update README, intro post, CLI help, embedded browser assets and all 17 UI locales for the session review interface.

Validation

• Full go test ./... suite and targeted race tests for quota/profile controls.
• Tests cover CLI compatibility and mode round trips, automatic per-session application, new sessions, manual overrides, mixed automatic/reviewed thresholds, stale quota, matching profiles and failures without retries.
• Regression coverage for stale settings notifications, thresholds changing during updates, error wording, notice wrapping, review lifecycle and composer preservation.
• Existing rendered hit tests cover split/wide/full detail, sizes and translated controls. Local binary rebuilt.
• Web endpoint tests cover authenticated confirmation, origin rejection, stale quota, settings/threshold/window/account drift, replay prevention, skip, automatic failure recovery and read-only exclusion.
• Browser regression run: 30 checks passed initially; corrected the extra empty native-request field caught by the remaining check, then reran it successfully along with profile/native approval and navigation checks. Frontend type/format checks and build pass. Go vet and targeted shared-controller race tests pass.

Available in the terminal and explicitly writable browser mode; shared app-server support for experimental thread/settings/update is required. Updates affect subsequent turns, not an already running turn. Concurrent edits in Codex remain subject to the backend's non-atomic settings update behaviour. Automatic browser policies run on the server even with no page open. They require explicit launch-time consent; attempt tracking remains in memory and resets on restart/new quota windows.

[Copilot]

🟡 Changes recommended

Unresolved review-state and verification defects can discard input or report stale and misleading outcomes.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Moves quota threshold profile reviews into terminal session details while preserving native Codex approvals as the highest priority.

Changes:

• Adds per-session quota pills, review controls, and confirmation handling.
• Improves quota-setting verification and diagnostics.
• Updates documentation, tests, and 17 locales.

File summaries

File	Description
README.md	Documents session-based profile reviews.
intro-post.md	Introduces the new workflow.
internal/ui/view.go	Removes Quota-page profile notice.
internal/ui/quota_step_down.go	Refactors per-session quota state.
internal/ui/quota_step_down_test.go	Updates quota workflow tests.
internal/ui/quota_reset.go	Restores reset-only controls.
internal/ui/monitor.go	Surfaces inventory errors.
internal/ui/monitor_summary.go	Adds quota attention pills.
internal/ui/monitor_prompt.go	Protects composers during reviews.
internal/ui/monitor_profile.go	Implements profile review UI.
internal/ui/monitor_profile_test.go	Tests profile review behavior.
internal/ui/monitor_detail.go	Integrates notices into details.
internal/ui/monitor_detail_activity.go	Adds profile control layout.
internal/ui/monitor_copy.go	Prevents copying hidden context.
internal/ui/monitor_context.go	Routes profile interactions.
internal/ui/monitor_context_modes.go	Tracks selected review type.
internal/ui/monitor_attention_actions_test.go	Tests stacked attention pills.
internal/ui/monitor_approval.go	Keeps profile and approval controls separate.
internal/ui/model.go	Handles profile scan and update results.
internal/ui/localisation_test.go	Extends localized screen coverage.
internal/i18n/locales/zh-Hans.json	Updates Simplified Chinese strings.
internal/i18n/locales/tr.json	Updates Turkish strings.
internal/i18n/locales/sv.json	Updates Swedish strings.
internal/i18n/locales/ru.json	Updates Russian strings.
internal/i18n/locales/pt-PT.json	Updates Portuguese strings.
internal/i18n/locales/pt-BR.json	Updates Brazilian Portuguese strings.
internal/i18n/locales/nl.json	Updates Dutch strings.
internal/i18n/locales/nb.json	Updates Norwegian strings.
internal/i18n/locales/ja.json	Updates Japanese strings.
internal/i18n/locales/it.json	Updates Italian strings.
internal/i18n/locales/fr.json	Updates French strings.
internal/i18n/locales/fi.json	Updates Finnish strings.
internal/i18n/locales/et.json	Updates Estonian strings.
internal/i18n/locales/es.json	Updates Spanish strings.
internal/i18n/locales/en-GB.json	Updates British English strings.
internal/i18n/locales/de.json	Updates German strings.
internal/i18n/locales/da.json	Updates Danish strings.
internal/codex/session_settings_unix.go	Verifies observed setting updates.
internal/codex/session_settings_unix_test.go	Tests notification verification.
internal/codex/quota_step.go	Canonicalizes service tiers.
internal/codex/quota_step_test.go	Tests explicit default tiers.
internal/codex/daemon_status_unix.go	Tracks settings notifications.

Review details

Suppressed comments (2)

internal/ui/quota_step_down.go:145

• Launching an inventory rescan leaves the existing profile confirmation armed, and the scan-result handler does not clear it either. The previously reviewed settings can therefore remain confirmable across a rescan, contrary to the review binding described by this PR. Disarm the confirmation before starting each scan.
  internal/codex/quota_step.go:72
• This canonicalization now treats a nil tier and an explicit "default" tier as equal, so a standard profile also matches sessions whose reconnect response contains default. The README contract still says that standard requires an unset explicit tier, so the documented matching behavior is now inconsistent with this change; update the profile documentation to describe both representations.

		return canonicalQuotaSessionTier(s.Tier) == "default"

• Files reviewed: 42/42 changed files
• Comments generated: 6
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Web control concurrency and profile error-state handling still need correction before approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

internal/ui/monitor_profile.go:57

• The terminal review displays an implicit default tier as unset, but an explicit default tier as default, while matching treats both as standard speed. It also prints a proposed default tier literally. When the model or effort changes, this can make the review imply a speed change that the write does not make. Use one display helper that renders both implicit and explicit defaults as standard for the current and proposed profiles.

• Files reviewed: 57/60 changed files
• Comments generated: 5
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Automatic retry, notice retention, outcome classification, and composer-preservation issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

web/src/SessionActions.svelte:330

• When SKIP is selected, this confirmation still says the action will be sent to Codex and may start work. The server's skip path only records the threshold as handled and returns without calling ApplyQuotaProfile, so the warning is inaccurate. Use skip-specific text stating that no Codex settings are changed.

• Files reviewed: 57/60 changed files
• Comments generated: 5
• Review effort level: Balanced