Add multi-account overview widgets

[aledeul]

Add an opt-in medium/large CodexBar Accounts widget that keeps the active account visible while browsing other saved accounts for the same provider. For example, an active account saved sixth still appears first, with one inactive account alongside it. The pager changes the displayed account only; it does not switch credentials. Accounts widgets for a provider share their remembered companion selection.

The widget reuses the existing Usage layout. This also carries the remaining Account Usage header/spacing refinements from #3921. Quotas, extra usage, and Today/30d rows stay account-specific. When an account has no attributed history, large tiles can show the provider's chart labelled Combined local [provider] history; account-owned history takes precedence. Existing account snapshots remain readable when the new active marker is absent.

This is the feature-only follow-up to #3921, based on current main. The Claude refresh and ownership fix adopted in #3930 / 0d84897 is already in the base and has no diff here. The existing single-account widget is retained.

Refs #3144. Maintainer decision requested: approve a separate opt-in Accounts widget under VISION.md. This PR does not assume that product sign-off has been granted.

Validation

• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer CODEXBAR_TEST_GROUP_SIZE=24 CODEXBAR_TEST_RETRY_NON_TIMEOUT_FAILURES=0 make test: all 1,373 selections / 67 groups passed on the first attempt, with no failures, timeouts, or retries.
• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer make check: zero violations in 2,620 files.
• Focused widget, snapshot compatibility, Claude freshness, and architecture checks: 105 tests in eight suites passed, plus the opt-in rendering XCTest. The render run used CODEXBAR_ACCOUNT_RENDER_DIR with Keychain access suppressed and test file isolation enabled.
• git diff --check passed. The widget implementation matches the previously reviewed feature branch; the already-landed Claude refresh/snapshot implementation and its tests have no diff against main.

Visual evidence

The native desktop screenshots below use anonymized Account 1/2 labels and the desktop's automatic monochrome appearance. They were captured for #3921; the widget implementation is unchanged in this extraction. Synthetic production-view renders were regenerated on this branch for all eight widget types and all 16 supported type/size combinations, in light/dark appearances with two/three quota windows (64 images). Small proof is a synthetic SwiftUI render with simulated widget margins, not a desktop WidgetKit capture.

Accounts medium — native	Accounts large — native	Account Usage small — synthetic

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 24, 2026, 1:56 AM ET / 05:56 UTC.

ClawSweeper review

What this changes

Adds medium and large Accounts widgets that show one provider’s active account beside a browsable saved account, plus snapshot compatibility, tests, screenshots, and widget documentation.

Merge readiness

⛔ Blocked before merge - 2 items remain

Current main and v0.65.0 have no multi-account overview widget, so this PR remains useful. The reviewed branch has no clear blocking code defect, and the supplied native images show the new tiles. The remaining blocker is the repository owner’s sign-off on adding a widget type.

Priority: P3
Reviewed head: 18c8d2c0bbed59104c1f45bfa772d040392f65ac
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Native widget captures and focused compatibility coverage support a sound feature patch; product acceptance remains open.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (screenshot): Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (screenshot): Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.
Evidence reviewed	8 items	Current-main boundary: Current main registers the single-account widget but has no Accounts overview widget; the latest release has the same widget list. Introduced widget: The PR adds a separate medium/large WidgetKit configuration and renders active and companion accounts from the selected provider. Saved-state compatibility: The added active marker decodes as false when absent from older account snapshot JSON; a focused test covers that legacy shape. Companion selection uses a new provider-scoped preference key.
Findings	None	None.
Security	None	None.

How this fits together

The CodexBar app publishes provider and account usage into a shared snapshot read by its macOS widgets. The new widget filters that snapshot by provider and uses a saved display selection to choose the companion account.

flowchart LR
  A[Provider account usage] --> B[Shared widget snapshot]
  B --> C[Provider account filter]
  D[Saved companion choice] --> E[Account pager]
  C --> E
  E --> F[Medium or large Accounts tile]

Loading

Decision needed

Question	Recommendation
Should CodexBar ship a separate opt-in medium/large Accounts widget for browsing saved accounts of one provider?	Approve separate Accounts widget: Ship this provider-scoped widget alongside the existing single-account and provider widgets.

Why: VISION.md reserves new features and meaningful maintenance complexity for sign-off, and the existing issue explicitly left the widget form undecided.

Before merge

• Complete next step (P2) - Obtain owner sign-off for the separate Accounts widget under VISION.md before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Code growth	production +518/−34 lines; tests +455/−6 lines	The new widget has substantial implementation and focused test coverage, making feature scope relevant to sign-off.
Widget gallery	1 widget type added	The added gallery choice is the user-facing product decision.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3144
Summary: This PR is a candidate implementation of the open multi-account widget request; the earlier combined PR was closed unmerged after its Claude freshness portion was adopted separately.

Members:

• canonical: Feature Request: Show usage for multiple accounts per provider on widget #3144 - The issue asks for multi-account widget presentation and remains open for a product decision.
• partial_overlap: Fix Claude swap widget freshness and show multiple accounts #3921 - The closed, unmerged PR contained an earlier version of this widget as well as separate Claude freshness work.
• adjacent_distinct: fix(claude): refresh widgets from active swap accounts #3930 - Its Claude freshness change is present on main, while its discussion explicitly leaves the multi-account UI separate.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

If the owner approves the feature, land the separate opt-in widget while retaining existing widget configurations and the legacy snapshot decode path.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a new widget capability. Current main and v0.65.0 register no Accounts overview widget.

Is this the best way to solve the issue?

Yes, subject to product sign-off: a separate opt-in widget reuses existing account snapshots and leaves established widgets available.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fec33b3bc619.

Labels

Label changes:

• add P3: This is an optional widget feature with no reported regression or blocked core workflow.
• add proof: sufficient: Contributor real behavior proof is sufficient. Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.

Label justifications:

• P3: This is an optional widget feature with no reported regression or blocked core workflow.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.
• proof: sufficient: Contributor real behavior proof is sufficient. Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. Downloaded native desktop captures show the new medium and large Accounts tiles displaying two account-specific rows and an Active marker. Pager and legacy-snapshot behavior have focused tests; the images do not demonstrate a chevron press. The stored model adds a defaulted field and a separate preference key, so existing snapshots and selections need no migration.

Evidence

What I checked:

• Current-main boundary: Current main registers the single-account widget but has no Accounts overview widget; the latest release has the same widget list. (Sources/CodexBarWidget/CodexBarWidgetBundle.swift:13, fec33b3bc619)
• Introduced widget: The PR adds a separate medium/large WidgetKit configuration and renders active and companion accounts from the selected provider. (Sources/CodexBarWidget/CodexBarAccountUsageWidget.swift:23, 18c8d2c0bbed)
• Saved-state compatibility: The added active marker decodes as false when absent from older account snapshot JSON; a focused test covers that legacy shape. Companion selection uses a new provider-scoped preference key. (Sources/CodexBarCore/WidgetAccountSnapshot.swift:31, 18c8d2c0bbed)
• Account isolation: The view admits only enabled, unambiguous accounts for the configured provider; the pager rejects active, missing, and foreign accounts. Its intent changes only the display selection. (Sources/CodexBarWidget/ProviderPager.swift:61, 18c8d2c0bbed)
• Native visual proof: The PR’s downloaded desktop captures visibly show medium and large two-account tiles with an Active marker. The small capture is explicitly a synthetic render; the images do not show a chevron interaction. (docs/screenshots/multi-account-widgets/accounts-medium-native.png, 18c8d2c0bbed)
• Product scope: VISION.md places new features and meaningful maintenance complexity under owner sign-off; this PR explicitly requests that decision. (VISION.md:13, fec33b3bc619)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Rokas Tarasevičius: Raw commit 0f8489d adds Sources/CodexBarWidget/CodexBarAccountUsageWidget.swift:6 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 0f8489dd8601; files: Sources/CodexBarWidget/CodexBarAccountUsageWidget.swift)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Thanks @aledeul. Keeping this open for a maintainer version. At 18c8d2c0bbed, production changes total 518 insertions and 34 deletions across 11 files—net +484, above this pass’s +120-line limit. Existing account-entry reuse is sound, and missing isActive decodes as false, preserving older snapshots. Paging persistence, combined local-history fallback, and shared tile-layout changes make the current scope too large. A bounded first version should consume existing account snapshots and quota rows, preserve refresh opt-in, ownership, unavailable states, privacy labels, and old configurations, and settle visible-account/overflow behavior before adding paging or combined history. No contributor revision is requested; this needs a maintainer implementation and synthetic before/after widget proof.

[steipete]

Thanks @aledeul for the implementation, tests, and widget images. The snapshot reuse and backward-compatible active marker are useful. I recommend closing this version because paging persistence, combined provider history, and changes to existing Account Usage widgets exceed the smaller quota-only overview we want to ship. The pager also covers only published accounts: the app caps that set at six, so additional configured accounts are absent from its count. We’ll keep #3144 open to settle the smaller overview’s visible-account and overflow behavior. No contributor revision is requested; adopted work will retain your credit.

[steipete]

Thanks @aledeul for the implementation and visual exploration. #4400 (now merged as 2b58ada) adopts the reusable widget configuration and provider-safe account filtering, with your co-author credit, in the smaller approved quota-only overview. It adds the four/eight row limits and a count for accounts beyond the six-account snapshot cap. Paging, combined history, and changes to existing Account Usage tiles remain outside this version. This PR is already closed; no contributor revision is requested.