Unexpected Codex usage attribution and rapid quota drain with VS Code Remote-SSH; Exec shown although I did not run codex exec

What version of the IDE extension are you using?

26.623.31443

What subscription do you have?

pro

Which IDE are you using?

VS Code

What platform is your computer?

Darwin 25.5.0 arm64 arm and Linux 6.6.34-9.tl4.x86_64 x86_64 unknown

What issue are you seeing?

I am seeing abnormal Codex usage/quota consumption and possible usage attribution issues.
Timeline:
Around Jun 24, 2026 21:30 Beijing time (UTC+8), VS Code Remote-SSH and Codex started freezing frequently.
On Jun 25, 2026, Codex usage was consumed unusually fast.
The usage chart for Jun 25 showed:Desktop App: 2%
Extension: 37%
Exec: 62%

<img width="808" height="680" alt="Image" src="https://github.com/user-attachments/assets/671f3548-ec8b-4850-a3a5-27a28b4df14c" />

Environment:
Local machine: macOS.
Editor setup: VS Code Remote-SSH connected to a Linux remote host.
Codex app / bundled CLI version observed in local session logs: 0.142.0.
Local Codex session metadata I checked showed: originator=Codex Desktop, source=vscode, thread_source=user.
Relevant configuration includes memories/Chronicle enabled: memories=true, chronicle=true, generate_memories=true, use_memories=true.
Model configuration: gpt-5.5 with reasoning effort xhigh.
Expected behavior:
If usage is attributed to Exec, I expected it to correspond to explicit non-interactive jobs such as codex exec, codex e, Codex Cloud exec tasks, CI, or another visible automation path.
Actual behavior:
I did not intentionally run codex exec, codex e, or codex cloud exec on Jun 25.
Local shell/workspace search did not find evidence that I manually invoked those commands.
The usage dashboard still attributed most usage to Exec.
During the same period, VS Code Remote-SSH and Codex were frequently freezing.
Relevant diagnostics:
One local Desktop/VS Code-sourced session showed token count events increasing rapidly, reaching about 1.2M total tokens within a few minutes.
codex_chronicle was running in the background.
The Chronicle resources directory was actively producing *10min-memory-summary.md files. A local check showed about 207 such files modified within one day.
On the remote host, there was also an orphaned node (vitest) process started around Jun 24 21:34 Beijing time, running near 100% CPU with PPID=1. This may explain part of the VS Code Remote-SSH freezing, but it does not explain why Codex usage was reported under Exec.
Questions:
Does the Exec usage bucket include background Codex processes such as Chronicle, memory generation, app-server jobs, or extension-triggered background work?
If yes, can the dashboard expose those as a separate category, or provide per-session/per-process attribution?
If no, could Desktop/Extension/Chronicle usage be incorrectly attributed to Exec?
Is there a supported way to map usage dashboard buckets back to local session IDs, background jobs, or logs?
I can provide sanitized local session metadata, token count snippets, app logs, and the in-app feedback/session ID if needed.

What steps can reproduce the bug?

i don't know

What is the expected behavior?

_No response_

Additional information

_No response_