Option to Notify Workspace Owner When Usage Limit is Reached (#16969)

## Summary
- Replace the manual `/notify-owner` flow with an inline confirmation
prompt when a usage-based workspace member hits a credits-depleted
limit.
- Fetch the current workspace role from the live ChatGPT
`accounts/check/v4-2023-04-27` endpoint so owner/member behavior matches
the desktop and web clients.
- Keep owner, member, and spend-cap messaging distinct so we only offer
the owner nudge when the workspace is actually out of credits.

## What Changed
- `backend-client`
- Added a typed fetch for the current account role from
`accounts/check`.
  - Mapped backend role values into a Rust workspace-role enum.
- `app-server` and protocol
  - Added `workspaceRole` to `account/read` and `account/updated`.
- Derived `isWorkspaceOwner` from the live role, with a fallback to the
cached token claim when the role fetch is unavailable.
- `tui`
  - Removed the explicit `/notify-owner` slash command.
- When a member is blocked because the workspace is out of credits, the
error now prompts:
- `Your workspace is out of credits. Request more from your workspace
owner? [y/N]`
  - Choosing `y` sends the existing owner-notification request.
- Choosing `n`, pressing `Esc`, or accepting the default selection
dismisses the prompt without sending anything.
- Selection popups now honor explicit item shortcuts, which is how the
`y` / `n` interaction is wired.

## Reviewer Notes
- The main behavior change is scoped to usage-based workspace members
whose workspace credits are depleted.
- Spend-cap reached should not show the owner-notification prompt.
- Owners and admins should continue to see `/usage` guidance instead of
the member prompt.
- The live role fetch is best-effort; if it fails, we fall back to the
existing token-derived ownership signal.

## Testing
- Manual verification
  - Workspace owner does not see the member prompt.
- Workspace member with depleted credits sees the confirmation prompt
and can send the nudge with `y`.
- Workspace member with spend cap reached does not see the
owner-notification prompt.

### Workspace member out of usage

https://github.com/user-attachments/assets/341ac396-eff4-4a7f-bf0c-60660becbea1

### Workspace owner
<img width="1728" height="1086" alt="Screenshot 2026-04-09 at 11 48
22 AM"
src="https://github.com/user-attachments/assets/06262a45-e3fc-4cc4-8326-1cbedad46ed6"
/>

codex-rs/core/src/account.rs

@@ -0,0 +1,20 @@
+use crate::config::Config;
+use codex_account::AddCreditsNudgeEmailStatus;
+use codex_account::SendAddCreditsNudgeEmailError;
+use codex_account::WorkspaceOwnership;
+use codex_login::AuthManager;
+use codex_login::CodexAuth;
+
+pub async fn send_add_credits_nudge_email(
+    config: &Config,
+    auth_manager: &AuthManager,
+) -> Result<AddCreditsNudgeEmailStatus, SendAddCreditsNudgeEmailError> {
+    codex_account::send_add_credits_nudge_email(config.chatgpt_base_url.clone(), auth_manager).await
+}
+
+pub async fn resolve_workspace_role_and_owner_for_auth(
+    chatgpt_base_url: &str,
+    auth: Option<&CodexAuth>,
+) -> WorkspaceOwnership {
+    codex_account::resolve_workspace_role_and_owner_for_auth(chatgpt_base_url, auth).await
+}

codex-rs/core/src/codex.rs

@@ -4784,6 +4784,10 @@ async fn submission_loop(sess: Arc<Session>, config: Arc<Config>, rx_sub: Receiv
                     handlers::set_thread_name(&sess, sub.id.clone(), name).await;
                     false
                 }
+                Op::SendAddCreditsNudgeEmail => {
+                    handlers::send_add_credits_nudge_email(&sess, &config, sub.id.clone()).await;
+                    false
+                }
                 Op::RunUserShellCommand { command } => {
                     handlers::run_user_shell_command(&sess, sub.id.clone(), command).await;
                     false
@@ -4880,6 +4884,8 @@ mod handlers {
     use crate::tasks::execute_user_shell_command;
     use codex_mcp::collect_mcp_snapshot_from_manager;
     use codex_mcp::compute_auth_statuses;
+    use codex_protocol::protocol::AddCreditsNudgeEmailResponseEvent;
+    use codex_protocol::protocol::AddCreditsNudgeEmailStatus;
     use codex_protocol::protocol::CodexErrorInfo;
     use codex_protocol::protocol::ErrorEvent;
     use codex_protocol::protocol::Event;
@@ -4924,6 +4930,48 @@ mod handlers {
         sess.close_unified_exec_processes().await;
     }
 
+    pub async fn send_add_credits_nudge_email(
+        sess: &Arc<Session>,
+        config: &Config,
+        sub_id: String,
+    ) {
+        match crate::send_add_credits_nudge_email(config, &sess.services.auth_manager).await {
+            Ok(status) => {
+                sess.send_event_raw(Event {
+                    id: sub_id,
+                    msg: EventMsg::AddCreditsNudgeEmailResponse(
+                        AddCreditsNudgeEmailResponseEvent {
+                            result: Ok(add_credits_nudge_email_status_to_event(status)),
+                        },
+                    ),
+                })
+                .await;
+            }
+            Err(err) => {
+                sess.send_event_raw(Event {
+                    id: sub_id,
+                    msg: EventMsg::AddCreditsNudgeEmailResponse(
+                        AddCreditsNudgeEmailResponseEvent {
+                            result: Err(err.to_string()),
+                        },
+                    ),
+                })
+                .await;
+            }
+        }
+    }
+
+    fn add_credits_nudge_email_status_to_event(
+        status: crate::AddCreditsNudgeEmailStatus,
+    ) -> AddCreditsNudgeEmailStatus {
+        match status {
+            crate::AddCreditsNudgeEmailStatus::Sent => AddCreditsNudgeEmailStatus::Sent,
+            crate::AddCreditsNudgeEmailStatus::CooldownActive => {
+                AddCreditsNudgeEmailStatus::CooldownActive
+            }
+        }
+    }
+
     pub async fn realtime_conversation_list_voices(sess: &Session, sub_id: String) {
         sess.send_event_raw(Event {
             id: sub_id,
@@ -7202,6 +7250,7 @@ fn realtime_text_for_event(msg: &EventMsg) -> Option<String> {
         | EventMsg::GetHistoryEntryResponse(_)
         | EventMsg::McpListToolsResponse(_)
         | EventMsg::ListSkillsResponse(_)
+        | EventMsg::AddCreditsNudgeEmailResponse(_)
         | EventMsg::RealtimeConversationListVoicesResponse(_)
         | EventMsg::SkillsUpdateAvailable
         | EventMsg::PlanUpdate(_)

codex-rs/core/src/codex_tests.rs

@@ -2008,6 +2008,7 @@ async fn set_rate_limits_retains_previous_credits() {
             unlimited: false,
             balance: Some("10.00".to_string()),
         }),
+        spend_control: None,
         plan_type: Some(codex_protocol::account::PlanType::Plus),
     };
     state.set_rate_limits(initial.clone());
@@ -2026,6 +2027,7 @@ async fn set_rate_limits_retains_previous_credits() {
             resets_at: Some(1_900),
         }),
         credits: None,
+        spend_control: None,
         plan_type: None,
     };
     state.set_rate_limits(update.clone());
@@ -2038,6 +2040,7 @@ async fn set_rate_limits_retains_previous_credits() {
             primary: update.primary.clone(),
             secondary: update.secondary,
             credits: initial.credits,
+            spend_control: None,
             plan_type: initial.plan_type,
         })
     );
@@ -2114,6 +2117,7 @@ async fn set_rate_limits_updates_plan_type_when_present() {
             unlimited: false,
             balance: Some("15.00".to_string()),
         }),
+        spend_control: None,
         plan_type: Some(codex_protocol::account::PlanType::Plus),
     };
     state.set_rate_limits(initial.clone());
@@ -2128,6 +2132,7 @@ async fn set_rate_limits_updates_plan_type_when_present() {
         }),
         secondary: None,
         credits: None,
+        spend_control: None,
         plan_type: Some(codex_protocol::account::PlanType::Pro),
     };
     state.set_rate_limits(update.clone());
@@ -2140,6 +2145,7 @@ async fn set_rate_limits_updates_plan_type_when_present() {
             primary: update.primary,
             secondary: update.secondary,
             credits: initial.credits,
+            spend_control: None,
             plan_type: update.plan_type,
         })
     );

codex-rs/core/src/lib.rs

@@ -5,6 +5,7 @@
 // the TUI or the tracing stack).
 #![deny(clippy::print_stdout, clippy::print_stderr)]
 
+mod account;
 mod apply_patch;
 mod apps;
 mod arc_monitor;
@@ -112,7 +113,13 @@ mod stream_events_utils;
 pub mod test_support;
 mod unified_exec;
 pub mod windows_sandbox;
+pub use account::resolve_workspace_role_and_owner_for_auth;
+pub use account::send_add_credits_nudge_email;
 pub use client::X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER;
+pub use codex_account::AddCreditsNudgeEmailStatus;
+pub use codex_account::SendAddCreditsNudgeEmailError;
+pub use codex_account::WorkspaceOwnership;
+pub use codex_account::WorkspaceRole;
 pub use codex_protocol::config_types::ModelProviderAuthInfo;
 mod event_mapping;
 pub mod review_format;

codex-rs/core/src/state/session.rs

@@ -229,6 +229,9 @@ fn merge_rate_limit_fields(
     if snapshot.credits.is_none() {
         snapshot.credits = previous.and_then(|prior| prior.credits.clone());
     }
+    if snapshot.spend_control.is_none() {
+        snapshot.spend_control = previous.and_then(|prior| prior.spend_control.clone());
+    }
     if snapshot.plan_type.is_none() {
         snapshot.plan_type = previous.and_then(|prior| prior.plan_type);
     }

codex-rs/core/src/state/session_tests.rs

@@ -48,6 +48,7 @@ async fn set_rate_limits_defaults_limit_id_to_codex_when_missing() {
         }),
         secondary: None,
         credits: None,
+        spend_control: None,
         plan_type: None,
     });
 
@@ -75,6 +76,7 @@ async fn set_rate_limits_defaults_to_codex_when_limit_id_missing_after_other_buc
         }),
         secondary: None,
         credits: None,
+        spend_control: None,
         plan_type: None,
     });
     state.set_rate_limits(RateLimitSnapshot {
@@ -87,6 +89,7 @@ async fn set_rate_limits_defaults_to_codex_when_limit_id_missing_after_other_buc
         }),
         secondary: None,
         credits: None,
+        spend_control: None,
         plan_type: None,
     });
 
@@ -118,6 +121,7 @@ async fn set_rate_limits_carries_credits_and_plan_type_from_codex_to_codex_other
             unlimited: false,
             balance: Some("50".to_string()),
         }),
+        spend_control: None,
         plan_type: Some(codex_protocol::account::PlanType::Plus),
     });
 
@@ -131,6 +135,7 @@ async fn set_rate_limits_carries_credits_and_plan_type_from_codex_to_codex_other
         }),
         secondary: None,
         credits: None,
+        spend_control: None,
         plan_type: None,
     });
 
@@ -150,6 +155,7 @@ async fn set_rate_limits_carries_credits_and_plan_type_from_codex_to_codex_other
                 unlimited: false,
                 balance: Some("50".to_string()),
             }),
+            spend_control: None,
             plan_type: Some(codex_protocol::account::PlanType::Plus),
         })
     );