@agentsdock/server 1.0.7-beta.5 → 1.0.8-beta.2

package/server/provider_usage.py

@@ -0,0 +1,241 @@
+"""Read-only provider allowance observations, separate from chat token usage.
+
+Codex exposes an account snapshot and update notifications. Claude exposes
+individual rate-limit events only; an omitted percentage never means zero.
+No credentials or provider payloads are persisted by this module.
+"""
+from __future__ import annotations
+
+import asyncio
+import copy
+import math
+import re
+import weakref
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any
+
+
+def timestamp() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def unavailable(backend: str, reason: str = "not_reported", *, account_kind: str = "unknown") -> dict:
+    return {"backend": backend, "status": "unavailable", "source": None,
+            "account_kind": account_kind, "observed_at": None, "windows": [], "reason": reason}
+
+
+def _number(value: Any, *, minimum: float = 0) -> float | None:
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        return None
+    return value if math.isfinite(value) and value >= minimum else None
+
+
+def _text(value: Any, limit: int = 100) -> str | None:
+    if not isinstance(value, str) or not value or len(value) > limit:
+        return None
+    return value if all(char.isprintable() for char in value) else None
+
+
+def _credits(value: Any) -> dict | None:
+    if not isinstance(value, dict) or not isinstance(value.get("hasCredits"), bool) or not isinstance(value.get("unlimited"), bool):
+        return None
+    # The native balance has no currency field. Keep its decimal representation;
+    # never infer dollars or return arbitrary provider text as a balance.
+    balance = value.get("balance")
+    if not isinstance(balance, str) or not re.fullmatch(r"\d{1,20}(?:\.\d{1,12})?", balance):
+        balance = None
+    return {"balance": balance, "has_credits": value["hasCredits"], "unlimited": value["unlimited"]}
+
+
+def _codex_bucket(value: Any, key: str, observed_at: str, previous: dict | None = None) -> dict:
+    bucket = copy.deepcopy(previous or {"windows": {}})
+    if not isinstance(value, dict):
+        return bucket
+    label = _text(value.get("limitName")) or (_text(value.get("limitId")) if key != "codex" else None)
+    for slot in ("primary", "secondary"):
+        if slot not in value:
+            continue
+        raw = value[slot]
+        used = _number(raw.get("usedPercent")) if isinstance(raw, dict) else None
+        if used is None:
+            # Notifications are sparse rolling updates. Null means unavailable
+            # in this observation, not recovery/reset of an earlier allowance.
+            continue
+        old_window = bucket["windows"].get(slot) or {}
+        bucket["windows"][slot] = {
+            "id": f"{key}:{slot}", "label": label or old_window.get("label"), "used_percent": used,
+            "resets_at": _number(raw.get("resetsAt")) if _number(raw.get("resetsAt")) is not None else old_window.get("resets_at"),
+            "window_minutes": _number(raw.get("windowDurationMins"), minimum=1) or old_window.get("window_minutes"),
+            "observed_at": observed_at,
+        }
+    credits = _credits(value.get("credits"))
+    if credits is not None:
+        if credits["balance"] is None and isinstance(bucket.get("credits"), dict):
+            credits["balance"] = bucket["credits"].get("balance")
+        bucket["credits"] = credits
+    return bucket
+
+
+def codex_buckets(payload: Any, observed_at: str, *, previous: dict | None = None) -> dict:
+    """Merge available event fields; full reads pass no previous snapshot."""
+    buckets = copy.deepcopy(previous or {})
+    if not isinstance(payload, dict):
+        return buckets
+    many = payload.get("rateLimitsByLimitId")
+    if isinstance(many, dict):
+        for raw_key, value in list(many.items())[:32]:
+            key = _text(raw_key)
+            if key:
+                buckets[key] = _codex_bucket(value, key, observed_at, buckets.get(key))
+    single = payload.get("rateLimits")
+    if isinstance(single, dict):
+        key = _text(single.get("limitId")) or "codex"
+        # The multi-bucket field is authoritative when both are supplied.
+        if not isinstance(many, dict) or key not in many:
+            buckets[key] = _codex_bucket(single, key, observed_at, buckets.get(key))
+    return buckets
+
+
+def codex_snapshot(buckets: dict, observed_at: str) -> dict:
+    windows = [window for bucket in buckets.values() for window in bucket["windows"].values()]
+    credits = (buckets.get("codex") or {}).get("credits")
+    if credits is None:
+        credits = next((bucket.get("credits") for bucket in buckets.values() if bucket.get("credits") is not None), None)
+    if not windows and credits is None:
+        return unavailable("codex", account_kind="chatgpt")
+    return {"backend": "codex", "status": "available", "source": "codex-account",
+            "account_kind": "chatgpt", "observed_at": observed_at, "windows": windows,
+            **({"credits": credits} if credits is not None else {})}
+
+
+def _field(value: Any, name: str) -> Any:
+    return value.get(name) if isinstance(value, dict) else getattr(value, name, None)
+
+
+_CLAUDE_WINDOWS = {
+    "five_hour": (None, 300), "seven_day": (None, 10080),
+    "seven_day_opus": ("Opus", 10080),
+    "seven_day_sonnet": ("Sonnet", 10080), "overage": (None, None),
+}
+_CLAUDE_STATUSES = {"allowed", "allowed_warning", "rejected"}
+
+
+def claude_window(message: Any, observed_at: str) -> dict | None:
+    info = _field(message, "rate_limit_info")
+    kind = _field(info, "rate_limit_type")
+    if not isinstance(kind, str) or kind not in _CLAUDE_WINDOWS:
+        return None
+    status = _field(info, "status")
+    if not isinstance(status, str) or status not in _CLAUDE_STATUSES:
+        status = None
+    utilization = _number(_field(info, "utilization"))
+    reset = _number(_field(info, "resets_at"))
+    if status is None and utilization is None and reset is None:
+        return None
+    label, minutes = _CLAUDE_WINDOWS[kind]
+    return {"id": kind, "label": label,
+            "used_percent": round(utilization * 100, 6) if utilization is not None else None,
+            "resets_at": reset, "window_minutes": minutes, "observed_at": observed_at,
+            **({"status": status} if status is not None else {})}
+
+
+@dataclass
+class _CodexState:
+    binding: tuple = ()
+    lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+    snapshot: dict | None = None
+    buckets: dict = field(default_factory=dict)
+    account_id: str | None = None
+
+
+class ProviderUsage:
+    def __init__(self) -> None:
+        self._codex: weakref.WeakKeyDictionary[Any, _CodexState] = weakref.WeakKeyDictionary()
+        self._claude: dict[str, tuple[str, dict]] = {}
+
+    @staticmethod
+    def _binding(manager: Any) -> tuple:
+        return (manager.generation, manager.client.account_epoch, manager.ready)
+
+    def invalidate_codex(self, manager: Any) -> None:
+        state = self._codex.get(manager)
+        if state is not None:
+            state.binding, state.snapshot, state.buckets, state.account_id = (), None, {}, None
+
+    async def read_codex(self, manager: Any, *, refresh: bool = False) -> dict:
+        if getattr(manager, "_agentsdock_provider_revision", None):
+            return unavailable("codex", "custom_endpoint", account_kind="custom")
+        state = self._codex.setdefault(manager, _CodexState())
+        async with state.lock:
+            if not refresh and state.snapshot is not None and state.binding == self._binding(manager):
+                return copy.deepcopy(state.snapshot)
+            try:
+                # Existing native authentication only. No login, token refresh,
+                # billing API, thread, or model request is issued here.
+                account = await manager.request("account/read", {"refreshToken": False})
+                binding = self._binding(manager)
+                raw_account = account.get("account") if isinstance(account, dict) else None
+                kind = raw_account.get("type") if isinstance(raw_account, dict) else None
+                if kind != "chatgpt" or account.get("requiresOpenaiAuth") is False:
+                    result = unavailable("codex", "account_usage_unavailable",
+                                         account_kind="api_key" if kind == "apiKey" else "custom" if kind == "chatgpt" else "unknown")
+                    state.buckets = {}
+                else:
+                    payload = await manager.request("account/rateLimits/read", {})
+                    if binding != self._binding(manager) or self._codex.get(manager) is not state:
+                        return unavailable("codex", "account_changed")
+                    state.buckets = codex_buckets(payload, timestamp())
+                    state.account_id = _text(payload.get("accountId"), 256) if isinstance(payload, dict) else None
+                    result = codex_snapshot(state.buckets, timestamp())
+                state.binding, state.snapshot = binding, result
+                return copy.deepcopy(result)
+            except Exception:
+                # Neither provider diagnostics nor old account values are a
+                # usable balance. A failed refresh stays non-fatal to the chat.
+                result = unavailable("codex", "temporarily_unavailable")
+                state.snapshot = None
+                state.buckets = {}
+                state.binding = self._binding(manager)
+                return result
+
+    def observe_codex(self, manager: Any, notification: dict) -> bool:
+        state = self._codex.get(manager)
+        if state is None or state.snapshot is None or state.snapshot.get("account_kind") != "chatgpt":
+            return False
+        if getattr(manager, "_agentsdock_provider_revision", None) or state.binding != self._binding(manager):
+            self.invalidate_codex(manager)
+            return True
+        payload = notification.get("params")
+        if not isinstance(payload, dict):
+            return False
+        account_id = _text(payload.get("accountId"), 256)
+        if state.account_id and account_id and account_id != state.account_id:
+            self.invalidate_codex(manager)
+            return True
+        observed_at = timestamp()
+        state.buckets = codex_buckets(payload, observed_at, previous=state.buckets)
+        state.snapshot = codex_snapshot(state.buckets, observed_at)
+        return True
+
+    def observe_claude(self, session_id: str, generation: str | None, message: Any) -> bool:
+        if not generation:
+            return False
+        observed_at = timestamp()
+        window = claude_window(message, observed_at)
+        if window is None:
+            return False
+        old_generation, old_windows = self._claude.get(session_id, (None, {}))
+        windows = dict(old_windows) if old_generation == generation else {}
+        windows[window["id"]] = window
+        self._claude[session_id] = (generation, windows)
+        return True
+
+    def read_claude(self, session_id: str, generation: str | None) -> dict:
+        old_generation, windows = self._claude.get(session_id, (None, {}))
+        if not generation or old_generation != generation:
+            self._claude.pop(session_id, None)
+            return unavailable("claude")
+        return {"backend": "claude", "status": "available", "source": "claude-events",
+                "account_kind": "subscription", "observed_at": max(w["observed_at"] for w in windows.values()),
+                "windows": copy.deepcopy(list(windows.values()))}

package/server/public_chat_shares.py

@@ -28,10 +28,9 @@ from typing import Any, Callable, Iterator
 from shared_chat_videos import normalize_shared_chat_videos
 
 
-MAX_MESSAGE_TEXT_BYTES = 256 * 1024
-MAX_SNAPSHOT_BYTES = 2 * 1024 * 1024
-MAX_RENDER_BYTES = 16 * 1024 * 1024
-MAX_SNAPSHOT_PAGE_MESSAGES = 100
+# Pagination targets, not quotas: one complete message may exceed a page target.
+TARGET_SNAPSHOT_PAGE_BYTES = 2 * 1024 * 1024
+TARGET_SNAPSHOT_PAGE_MESSAGES = 100
 MAX_TITLE_CHARACTERS = 256
 MAX_LIST_LIMIT = 100
 MAX_UNIX_TIMESTAMP = 253402300799
@@ -41,7 +40,7 @@ SHARE_ID_PATTERN = re.compile(r"share_[a-f0-9]{32}\Z", re.ASCII)
 
 
 class PublicChatShareValidationError(ValueError):
-    """Input is not an already-projected, bounded public conversation."""
+    """Input is not an already-projected public conversation."""
 
 
 class PublicChatShareUnavailable(LookupError):
@@ -62,15 +61,15 @@ def _timestamp(value: Any, label: str) -> int | float:
     return value
 
 
-def _utf8_size(value: str, label: str, limit: int) -> int:
+def _utf8_size(value: str, label: str, limit: int | None = None) -> int:
     # Check character count first to avoid encoding a grossly oversized input.
-    if len(value) > limit:
+    if limit is not None and len(value) > limit:
         raise PublicChatShareValidationError(f"{label} is too large.")
     try:
         length = len(value.encode("utf-8"))
     except UnicodeEncodeError as exc:
         raise PublicChatShareValidationError(f"{label} must be valid UTF-8.") from exc
-    if length > limit:
+    if limit is not None and length > limit:
         raise PublicChatShareValidationError(f"{label} is too large.")
     return length
 
@@ -82,47 +81,39 @@ def _session_id(value: Any) -> str:
     return value
 
 
+def _projected_message(message: Any) -> dict[str, Any]:
+    if not isinstance(message, dict) or set(message) - {"role", "text", "timestamp", "videos"}:
+        raise PublicChatShareValidationError("Messages may contain only role, text, timestamp, and videos.")
+    role = message.get("role")
+    text = message.get("text")
+    if role not in ("user", "assistant") or not isinstance(text, str):
+        raise PublicChatShareValidationError("Each message needs a user/assistant role and text.")
+    _utf8_size(text, "message text")
+    item = {"role": role, "text": text}
+    if "videos" in message:
+        try:
+            videos = normalize_shared_chat_videos(message["videos"])
+        except ValueError as exc:
+            raise PublicChatShareValidationError("Invalid shared video metadata.") from exc
+        if videos:
+            item["videos"] = videos
+    if "timestamp" in message:
+        item["timestamp"] = _timestamp(message["timestamp"], "message timestamp")
+    return item
+
+
 def _snapshot(messages: Any, title: Any, created_at: Any) -> tuple[dict[str, Any], bytes]:
     if title is None:
         title = DEFAULT_TITLE
     if not isinstance(title, str) or not title.strip() or len(title) > MAX_TITLE_CHARACTERS:
         raise PublicChatShareValidationError("title must contain 1 to 256 characters.")
-    total_bytes = _utf8_size(title, "title", MAX_TITLE_CHARACTERS * 4)
+    _utf8_size(title, "title", MAX_TITLE_CHARACTERS * 4)
     _timestamp(created_at, "created_at")
     if not isinstance(messages, list) or not messages:
         raise PublicChatShareValidationError("messages must contain at least one item.")
-    serialized_bytes = len(json.dumps({"title": title, "created_at": created_at, "messages": []},
-        ensure_ascii=False, separators=(",", ":"), allow_nan=False).encode("utf-8"))
-    projected: list[dict[str, Any]] = []
-    for message in messages:
-        if not isinstance(message, dict) or set(message) - {"role", "text", "timestamp", "videos"}:
-            raise PublicChatShareValidationError("Messages may contain only role, text, timestamp, and videos.")
-        role = message.get("role")
-        text = message.get("text")
-        if role not in ("user", "assistant") or not isinstance(text, str):
-            raise PublicChatShareValidationError("Each message needs a user/assistant role and text.")
-        total_bytes += _utf8_size(text, "message text", MAX_MESSAGE_TEXT_BYTES)
-        if total_bytes > MAX_SNAPSHOT_BYTES:
-            raise PublicChatShareValidationError("Snapshot is too large.")
-        item = {"role": role, "text": text}
-        if "videos" in message:
-            try:
-                videos = normalize_shared_chat_videos(message["videos"])
-            except ValueError as exc:
-                raise PublicChatShareValidationError("Invalid shared video metadata.") from exc
-            if videos:
-                item["videos"] = videos
-        if "timestamp" in message:
-            item["timestamp"] = _timestamp(message["timestamp"], "message timestamp")
-        serialized_bytes += len(json.dumps(item, ensure_ascii=False, separators=(",", ":"),
-            allow_nan=False).encode("utf-8")) + bool(projected)
-        if serialized_bytes > MAX_SNAPSHOT_BYTES:
-            raise PublicChatShareValidationError("Snapshot is too large.")
-        projected.append(item)
+    projected = [_projected_message(message) for message in messages]
     snapshot = {"title": title, "created_at": created_at, "messages": projected}
     encoded = json.dumps(snapshot, ensure_ascii=False, separators=(",", ":"), allow_nan=False).encode("utf-8")
-    if len(encoded) > MAX_SNAPSHOT_BYTES:
-        raise PublicChatShareValidationError("Snapshot is too large.")
     return snapshot, encoded
 
 
@@ -171,7 +162,7 @@ class PublicChatShareStore:
                     created_at REAL NOT NULL,
                     expires_at REAL,
                     message_count INTEGER NOT NULL CHECK(message_count >= 1),
-                    snapshot_json BLOB NOT NULL CHECK(length(snapshot_json) <= 2097152),
+                    snapshot_json BLOB NOT NULL,
                     snapshot_sha256 BLOB NOT NULL CHECK(length(snapshot_sha256) = 32)
                 )"""
             )
@@ -181,21 +172,37 @@ class PublicChatShareStore:
                     revoked_at REAL NOT NULL
                 )"""
             )
+        connection.execute(f"""CREATE TABLE IF NOT EXISTS public_chat_share_pages{suffix} (
+            share_id TEXT NOT NULL REFERENCES public_chat_shares{suffix}(share_id) DEFERRABLE INITIALLY DEFERRED,
+            page_index INTEGER NOT NULL CHECK(page_index >= 1),
+            snapshot_json BLOB NOT NULL,
+            snapshot_sha256 BLOB NOT NULL CHECK(length(snapshot_sha256) = 32),
+            PRIMARY KEY(share_id, page_index))""")
 
     @classmethod
     def _ensure_schema(cls, connection):
-        """Authenticated-write-only, atomic preservation of immutable v1 rows."""
+        """Authenticated-write-only, atomic preservation of existing snapshots."""
         version = connection.execute("PRAGMA user_version").fetchone()[0]
         if version not in (0, 1, 2, 3):
             raise OSError("Unsupported public chat share database version.")
-        if version == 1:
-            cls._create_tables(connection, "_v2")
-            connection.execute("INSERT INTO public_chat_shares_v2 SELECT * FROM public_chat_shares")
-            connection.execute("INSERT INTO public_chat_share_revocations_v2 SELECT * FROM public_chat_share_revocations")
+        # Only the old SQL size constraints change; columns and persisted JSON
+        # are identical. Keep schema version 3 so a previous server can reopen
+        # its existing shares after rollback instead of refusing the database.
+        bounded_schema = any(re.search(r"CHECK\s*\(\s*length\s*\(\s*snapshot_json\s*\)", row[0] or "", re.IGNORECASE)
+            for row in connection.execute("SELECT sql FROM sqlite_master WHERE type='table' AND name IN ('public_chat_shares','public_chat_share_pages')"))
+        if version == 1 or bounded_schema:
+            cls._create_tables(connection, "_expanded")
+            connection.execute("INSERT INTO public_chat_shares_expanded SELECT * FROM public_chat_shares")
+            connection.execute("INSERT INTO public_chat_share_revocations_expanded SELECT * FROM public_chat_share_revocations")
+            has_pages = connection.execute("SELECT 1 FROM sqlite_master WHERE type='table' AND name='public_chat_share_pages'").fetchone()
+            if has_pages:
+                connection.execute("INSERT INTO public_chat_share_pages_expanded SELECT * FROM public_chat_share_pages")
+                connection.execute("DROP TABLE public_chat_share_pages")
             connection.execute("DROP TABLE public_chat_share_revocations")
             connection.execute("DROP TABLE public_chat_shares")
-            connection.execute("ALTER TABLE public_chat_shares_v2 RENAME TO public_chat_shares")
-            connection.execute("ALTER TABLE public_chat_share_revocations_v2 RENAME TO public_chat_share_revocations")
+            connection.execute("ALTER TABLE public_chat_shares_expanded RENAME TO public_chat_shares")
+            connection.execute("ALTER TABLE public_chat_share_revocations_expanded RENAME TO public_chat_share_revocations")
+            connection.execute("ALTER TABLE public_chat_share_pages_expanded RENAME TO public_chat_share_pages")
         else:
             cls._create_tables(connection)
         connection.execute(
@@ -208,12 +215,6 @@ class PublicChatShareStore:
                     f"BEFORE {operation} ON {table} BEGIN "
                     "SELECT RAISE(ABORT, 'Public chat shares are immutable'); END"
                 )
-        connection.execute("""CREATE TABLE IF NOT EXISTS public_chat_share_pages (
-            share_id TEXT NOT NULL REFERENCES public_chat_shares(share_id) DEFERRABLE INITIALLY DEFERRED,
-            page_index INTEGER NOT NULL CHECK(page_index >= 1),
-            snapshot_json BLOB NOT NULL CHECK(length(snapshot_json) <= 2097152),
-            snapshot_sha256 BLOB NOT NULL CHECK(length(snapshot_sha256) = 32),
-            PRIMARY KEY(share_id, page_index))""")
         for operation in ("UPDATE", "DELETE"):
             connection.execute(f"CREATE TRIGGER IF NOT EXISTS public_chat_share_pages_no_{operation.lower()} "
                 f"BEFORE {operation} ON public_chat_share_pages BEGIN "
@@ -351,11 +352,12 @@ class PublicChatShareStore:
         return True
 
     def create_streamed_share(self, session_id: str, load_messages: Callable, *, title=None, expires_at=None) -> dict[str, Any]:
-        """Capture arbitrarily many bounded pages atomically from a message sink.
+        """Capture complete messages in paginated snapshots atomically.
 
         The loader must emit projected messages synchronously and raise before
         returning if a reviewed digest changed. No whole-chat list/JSON is kept.
         Existing snapshots retain their original first-page representation.
+        A message larger than the page target is stored intact on its own page.
         """
         session_id = _session_id(session_id)
         created_at = _timestamp(self._now(), "current time")
@@ -392,10 +394,9 @@ class PublicChatShareStore:
 
             def emit(message) -> None:
                 nonlocal total, page_bytes
-                checked, _ = _snapshot([message], title, created_at)
-                item = checked["messages"][0]
+                item = _projected_message(message)
                 size = len(json.dumps(item, ensure_ascii=False, separators=(",", ":"), allow_nan=False).encode("utf-8"))
-                if page and (len(page) >= MAX_SNAPSHOT_PAGE_MESSAGES or overhead + page_bytes + size + len(page) > MAX_SNAPSHOT_BYTES):
+                if page and (len(page) >= TARGET_SNAPSHOT_PAGE_MESSAGES or overhead + page_bytes + size + len(page) > TARGET_SNAPSHOT_PAGE_BYTES):
                     flush()
                 page.append(item)
                 page_bytes += size
@@ -455,7 +456,7 @@ class PublicChatShareStore:
         encoded = row["snapshot_json"]
         digest = row["snapshot_sha256"]
         if (
-            not isinstance(encoded, bytes) or len(encoded) > MAX_SNAPSHOT_BYTES
+            not isinstance(encoded, bytes)
             or not isinstance(digest, bytes)
             or not hmac.compare_digest(hashlib.sha256(encoded).digest(), digest)
         ):
@@ -753,7 +754,4 @@ def render_public_chat_html(snapshot: dict[str, Any], *, page: int = 0, page_cou
         parts.append('</div>')
         parts.append('</section>')
     parts.append(f'</div>{navigation}<footer class="conversation-footer"><p>This is a saved copy. Replies and updates stay in the original chat.</p><p class="footer-brand">Shared with AgentsDock</p></footer><div id="conversation-end"></div></main></body></html>')
-    rendered = "".join(parts).encode("utf-8")
-    if len(rendered) > MAX_RENDER_BYTES:
-        raise PublicChatShareValidationError("Rendered snapshot is too large.")
-    return rendered
+    return "".join(parts).encode("utf-8")

package/server/public_chat_transcript.py

@@ -1,4 +1,4 @@
-"""Bounded, explicit projection of durable chat text for public snapshots.
+"""Record-at-a-time projection of durable chat text for public snapshots.
 
 Never imports the server or reads provider logs. Callers supply the existing
 private-event projection and a validated events path. Nothing runs on import.
@@ -13,20 +13,11 @@ import os
 from pathlib import Path
 import re
 import stat
-import time
 from typing import Callable
 
 from shared_chat_videos import normalize_shared_chat_videos
 
-# Retained for the legacy incremental text-view adapter, not full snapshots.
-MAX_LOG_BYTES = 64 * 1024 * 1024
-MAX_LINE_BYTES = 1024 * 1024
-MAX_RECORDS = 100_000
-MAX_MESSAGES = 1_000
-MAX_SCAN_SECONDS = 30
 MAX_SNAPSHOT_BOUNDARY = (1 << 53) - 1
-MAX_TEXT_BYTES = 2 * 1024 * 1024
-MAX_MESSAGE_BYTES = 256 * 1024
 MAX_UNIX_TIMESTAMP = 253402300799
 
 
@@ -164,8 +155,6 @@ def make_public_event_projector(
         )
         if internal:
             (private_runs if run else private_segments).add(run)
-            if len(private_runs) + len(private_segments) > MAX_RECORDS:
-                raise PublicTranscriptError("Chat history metadata exceeds the snapshot processing limit")
         if run in private_runs or run in private_segments or not event_is_visible(event):
             return None
         projected = project_provider_event(event, session_id)
@@ -184,8 +173,6 @@ def make_public_event_projector(
             and _complete_imported_delivery_envelope(prompt)
         ):
             private_segments.add(run)
-            if len(private_runs) + len(private_segments) > MAX_RECORDS:
-                raise PublicTranscriptError("Chat history metadata exceeds the snapshot processing limit")
             prompt = ""
         return {**projected, "prompt": prompt}
 
@@ -205,7 +192,9 @@ def read_public_transcript(
     exact projected messages. Derived egress repair state must not change the
     text between preview and creation without requiring a fresh review. An incomplete
     final write is not a message and is left out of a preview. Corrupt complete
-    records and limits fail explicitly instead of publishing a truncated log.
+    records fail explicitly instead of publishing a truncated log. Records are
+    read one at a time without a chat-size or message-size quota; a large private
+    tool record is still excluded by the same event projection as a small one.
     """
     if through_bytes is not None and (
         type(through_bytes) is not int or not 0 < through_bytes <= MAX_SNAPSHOT_BOUNDARY
@@ -217,8 +206,6 @@ def read_public_transcript(
     outputs: dict[str, tuple[set[bytes], object, int]] = {}
     message_count = 0
     projected_digest = hashlib.sha256(b"[")
-    serialized_bytes = 2  # The JSON array delimiters; include every message's metadata/escaping.
-    deadline = time.monotonic() + MAX_SCAN_SECONDS
     digest = hashlib.sha256()
     consumed = 0
     try:
@@ -234,11 +221,9 @@ def read_public_transcript(
             if boundary > initial.st_size:
                 raise PublicTranscriptError("Chat changed; preview it again")
             while consumed < boundary:
-                if time.monotonic() >= deadline:
-                    raise PublicTranscriptError("Chat snapshot processing timed out; no partial snapshot was created")
-                line = stream.readline(min(MAX_LINE_BYTES + 1, boundary - consumed))
-                if len(line) > MAX_LINE_BYTES:
-                    raise PublicTranscriptError("A chat record exceeds the sharing limit")
+                # Bound the read to this immutable snapshot, not an arbitrary
+                # record size. readline retains at most the current raw record.
+                line = stream.readline(boundary - consumed)
                 if not line.endswith(b"\n"):
                     if through_bytes is not None:
                         raise PublicTranscriptError("Chat changed; preview it again")
@@ -251,7 +236,7 @@ def read_public_transcript(
                     raise PublicTranscriptError("Chat history contains an unreadable record") from exc
                 if not isinstance(raw, dict):
                     raise PublicTranscriptError("Chat history contains an invalid record")
-                # Avoid parsing/projecting arbitrary tool results and payloads.
+                # Validate raw records, but never project tool results/payloads.
                 kind = raw.get("type")
                 if not isinstance(kind, str):
                     raise PublicTranscriptError("Chat history contains an invalid event type")
@@ -291,11 +276,9 @@ def read_public_transcript(
                 # Preserve the reviewed plaintext, including indentation and
                 # leading/trailing newlines. Strip only for emptiness/dedup.
                 try:
-                    size = len(text.encode("utf-8"))
+                    text.encode("utf-8")
                 except UnicodeEncodeError as exc:
                     raise PublicTranscriptError("Chat history contains invalid Unicode text") from exc
-                if size > MAX_MESSAGE_BYTES:
-                    raise PublicTranscriptError("A message exceeds the 256 KiB sharing limit")
                 normalized = " ".join(text.split())
                 normalized_digest = hashlib.sha256(normalized.encode("utf-8")).digest()
                 previous = outputs.get(run)
@@ -324,9 +307,6 @@ def read_public_transcript(
                     message["timestamp"] = timestamp
                 encoded_message = json.dumps(message, ensure_ascii=False, sort_keys=True,
                     separators=(",", ":"), allow_nan=False).encode("utf-8")
-                serialized_bytes += len(encoded_message) + bool(message_count)
-                if message_sink is None and serialized_bytes > MAX_TEXT_BYTES:
-                    raise PublicTranscriptError("Readable chat preview exceeds 2 MiB; create a paginated share instead")
                 if message_count:
                     projected_digest.update(b",")
                 projected_digest.update(encoded_message)
@@ -335,8 +315,6 @@ def read_public_transcript(
                 else:
                     message_sink(message)
                 message_count += 1
-            if time.monotonic() >= deadline:
-                raise PublicTranscriptError("Chat snapshot processing timed out; no partial snapshot was created")
             final = os.fstat(stream.fileno())
             # Appends are allowed, rewrites/truncation of the prefix are not.
             if final.st_size < initial.st_size or (

package/server/pyproject.toml

@@ -7,6 +7,7 @@ dependencies = [
   "croniter>=6,<7",
   "cryptography>=50.0.1,<51",
   "fastapi>=0.115,<1",
+  "httpx>=0.28.1,<1",
   "pydantic>=2.10,<3",
   "python-dateutil>=2.9,<3",
   "python-multipart>=0.0.20,<1",