Stop loss and ceilings
A run that goes wrong can spend a whole usage window or a lot of money in minutes. Stop losses stop one turn that is running away. Ceilings stop all work on an account once it has spent the share you set aside.
The run guard
Settings > Harness > Run guard has the Harness enabled switch, on by default. While it is on, Warshall watches every run and applies the stop losses below. It only reads what the provider already reports, so watching a run adds nothing to your usage.
It also checks the account when a run starts. If one of its windows is 90% used or more, a notice says the run may not fit the window. The notice never stops or delays the run.
Stop losses
Settings > Harness > Stop losses has one box per limit and a switch for the whole section. A limit set to 0 is off.
| Limit | Default | What it does |
|---|---|---|
| Output tokens per turn | 250000 | Stops a turn after this many output tokens. |
| Subagents per turn | 5 | Caps the subagents one turn may start, on every provider. |
| Minutes per turn | 30 | Stops a turn that runs longer than this. |
| 5h window use per run | 50% | Stops a run that uses this share of the 5 hour window. |
| Weekly window use per run | 20% | Stops a run that uses this share of a weekly window, per model weekly windows included. |
| Cost alert | $10 | Tells you after a turn that cost more than this. |
| Hard budget per run | 0, off | A hard cap on API key spend, handed to Claude Code itself. In CLI session mode it caps the whole live session. In headless mode it caps each turn. |
The defaults are generous on purpose. A long agentic turn doing real work stays well under them. Subagents are the exception. A turn that fans out past a handful of them is spending several usage windows at once.
Windows or dollars, never both
A run on a subscription account spends its usage window and never a dollar, so only the two window limits apply to it. A run on an API key spends money, so the cost alert and the hard budget apply instead. A dollar figure against a subscription run is not a smaller warning. It is the wrong one. The token, subagent and minute limits apply to every run, whatever pays for it.
What each provider can enforce
| Limit | Claude | Codex | Custom endpoint |
|---|---|---|---|
| Output tokens per turn | Yes | No | Yes |
| Subagents per turn | Yes | Yes | No subagents |
| Minutes per turn | Yes | Yes | Yes |
| Window use per run | Yes | Yes | No windows |
| Cost alert | Yes | No | No |
| Hard budget per run | Yes | No | No |
Codex reports tokens and cost only when a turn ends, so there is nothing to act on mid turn. Its safety nets are the clock, the subagent count and the window limits. Its subagents are counted as each one is requested, at the approval check every tool call already passes. A model on a custom endpoint reports its tokens as it goes, so the token and minute limits hold. It has no usage windows and reports no cost.
When a limit trips
A STOP LOSS card appears at the bottom right with the reason and a six second countdown, and the terminal prints a line naming the limit.
- Press Keep running and the run carries on. That one limit doubles for the rest of the turn and stays armed, so a real runaway is caught again.
- Do nothing and the run is stopped when the countdown ends. The card turns into RUN STOPPED and the terminal prints which limit did it.
The cost alert never stops anything. A turn’s cost is only known once it has finished, so it arrives as a notice.
Ceilings
A ceiling is the share of an account’s weekly or monthly usage you do not want to go past. Set it on the account’s row in Settings > Accounts, in the Weekly Ceiling Limit box right after the address.
- Type a whole percent and press Enter or click away. A number outside 1 to 99 is moved to the nearest end of that range.
- A check mark beside the box shows the value is saved. It goes away while you type a new one.
- Clear the box for no ceiling.
The point is to prompt without watching the meter. When the account reaches the share you set, every terminal on it stops and new prompts wait, so what is left of the window goes to the work you then choose.
- Before a run, the account’s usage is checked. Past the ceiling nothing starts. The terminal prints a line like
Ceiling limit of this plan hit: 82% of Weekly · all models used, ceiling 80%with a Continue button. When several windows are past it, the worst one is named. - During a run, each account with a ceiling is read again every two minutes. When it crosses, every running terminal on that account prints the same line and its run stops.
- Continue is for that terminal alone. It runs on past the window that stopped it, on that account, until that window resets. Its last prompt is sent again the way Auto continue sends one, and the button then reads Continued. Other terminals on the account keep waiting.
A plan can report more than one weekly window, such as one for all models and one for a single model. The same ceiling applies to each, and each stops the work on its own. A Continue frees only the window that stopped that terminal.
A Continue on a line from before a restart frees nothing. The next run reads the meter and prints the line again, and a Continue on that new line counts.
Autopilot never sends a pooled run to an account past its ceiling. When every account of the provider is past it, the run goes to the active account and the ceiling check stops it there.
Session windows of a few hours are never ceilinged. They come back within hours, and the provider’s own limit already stops the work there. The box only appears on a subscription that reports a window of a day or longer. API keys and custom endpoints have none.