bug: /usage-limits counts the same subscription more than once

[stephenjason89]

Summary

/usage-limits can count one subscription more than once when multiple native provider instances are authenticated with the same provider account. The banner then reports the number of provider records as if they were distinct subscription accounts and renders identical quota windows twice.

A real example showed 3 accounts for Codex even though the connected CLIProxyAPI hub contained only two Codex auth files. The first and third rows had the same plan, weekly percentage, reset time, and reset credit because they represented the same subscription through duplicate native instances.

Reproduction

1. Configure two native Codex provider instances that resolve to the same authenticated email, such as a default instance and a proxy-backed instance.
2. Optionally connect a CLIProxyAPI usage hub containing that account.
3. Run /usage-limits in a Codex thread.
4. Observe that the account count includes both native instances and the same limits appear twice.

Expected

Count a subscription once when its provider and normalized email match. Keep instances without an email separate because T3 cannot prove they are the same account.

Cause

collectProviderUsageLimits deduplicates CLIProxy accounts against native accounts with the existing provider-and-email identity key, but it appends every native provider instance without applying that same identity rule.

Scope note

Claude accounts not appearing in this banner is expected when the command runs in a Codex thread. /usage-limits is scoped to the current thread provider. This issue covers only the incorrect duplicate count and duplicate rows.

Proposed fix: #10700

[juliusmarminge]

Triage

Confirmed. /usage-limits can count one subscription more than once when multiple native provider instances share the same authenticated email.

collectProviderUsageLimits already skips CLIProxy hub accounts that match a native accountKey(driver, normalized email), but it still appends every native instance. The composer banner then reports accounts.length and renders the same quota windows twice. Instances with no email stay separate, which is correct — T3 cannot prove those are the same account.

The Usage → Limits path (collectLimitAccounts) already merges that identity key. The /usage-limits command does not.

Scope: Claude missing from a Codex-thread banner is expected; the command is scoped to the current thread provider.

Fix: #10700 applies the same native identity key and adds a regression test. First-wins is enough for the double-count. Reviewers can optionally prefer the freshest usable snapshot when duplicates disagree.

No further issue work needed beyond reviewing that PR.