@agentsdock/server 1.0.7-beta.5 → 1.0.8

package/server/codex_app_server.py

@@ -354,6 +354,12 @@ class CodexAppServerTurn:
     # Native turn identities are retained only for this owner's lifetime.
     # Delayed duplicate starts must not resurrect one of its finished turns.
     _completed_turn_ids: set[str] = field(default_factory=set)
+    # Unlike turn_id, this identity does not follow native goal/child turns.
+    # History repair needs the turn that accepted the original user input.
+    initial_turn_id: str = field(init=False, default="")
+
+    def __post_init__(self) -> None:
+        self.initial_turn_id = self.turn_id
 
     async def next_notification(self, timeout: float | None = None) -> dict[str, Any]:
         return await self._subscription.next_notification(timeout)
@@ -498,6 +504,8 @@ class CodexAppServerTurn:
                 f"provisional turn already bound to {self.turn_id}, not {resolved}"
             )
         self.turn_id = resolved
+        if not self.initial_turn_id:
+            self.initial_turn_id = resolved
         if not self._retain_thread_stream:
             self._subscription.turn_id = resolved
 
@@ -562,6 +570,7 @@ class CodexAppServerClient:
         process_factory: ProcessFactory | None = None,
         before_start: Callable[[], Awaitable[Any]] | None = None,
         server_request_handler: ServerRequestHandler | None = None,
+        notification_guard: Callable[[dict[str, Any]], bool] | None = None,
         initialize_params: dict[str, Any] | None = None,
         on_process_started: ProcessLifecycleHook | None = None,
         on_process_exited: ProcessLifecycleHook | None = None,
@@ -599,6 +608,7 @@ class CodexAppServerClient:
         # arbitrary/recycled PIDs, so never derive a signal target from them.
         self._owns_spawned_process_groups = process_factory is None and os.name == "posix"
         self._server_request_handler = server_request_handler or decline_server_request
+        self._notification_guard = notification_guard
         self._initialize_params = initialize_params or {
             "clientInfo": {
                 "name": "agents_server",
@@ -635,6 +645,8 @@ class CodexAppServerClient:
         self._thread_names: dict[str, str] = {}
         self._subscriptions: set[CodexAppServerSubscription] = set()
         self._notification_handlers: set[NotificationHandler] = set()
+        self._account_usage_handlers: set[NotificationHandler] = set()
+        self._account_epoch = 0
         self._callback_tasks: set[asyncio.Task[Any]] = set()
         self._callback_tails: dict[
             tuple[NotificationHandler, str],
@@ -1401,10 +1413,19 @@ class CodexAppServerClient:
         # Authentication notifications are not chat events. Do not expose
         # account metadata or upstream login errors to event subscribers.
         if method in {"account/login/completed", "account/updated"}:
+            self._account_epoch += 1
+            self._dispatch_notification_handlers(
+                {"method": "account/changed", "params": {}},
+                tuple(self._account_usage_handlers), ordered=False,
+            )
             return
         params = notification.get("params")
         if not isinstance(params, dict):
             return
+        if method == "account/rateLimits/updated":
+            self._dispatch_notification_handlers(
+                notification, tuple(self._account_usage_handlers), ordered=False,
+            )
 
         if method == "serverRequest/resolved":
             request_id = params.get("requestId")
@@ -1438,6 +1459,8 @@ class CodexAppServerClient:
             # keeping this id current is required for both event routing and
             # turn/interrupt to target the work that is actually running.
             if not active_turn.turn_id or method == "turn/started":
+                if not active_turn.initial_turn_id:
+                    active_turn.initial_turn_id = turn_id
                 active_turn.turn_id = turn_id
                 if method == "turn/started":
                     active_turn._completed = False
@@ -1457,35 +1480,14 @@ class CodexAppServerClient:
                 "at": time.time(),
             })
 
-        for handler in tuple(self._notification_handlers):
-            owner = (handler, thread_id or "")
-            previous = self._callback_tails.get(owner)
-            if previous is None:
-                try:
-                    result = handler(notification)
-                except Exception:
-                    continue
-                if not inspect.isawaitable(result):
-                    # Preserve the original inline contract for synchronous
-                    # caches consumed by immediately following server requests.
-                    continue
-                task = asyncio.ensure_future(result)
-            else:
-                task = asyncio.create_task(
-                    self._invoke_notification_handler(
-                        handler,
-                        notification,
-                        previous,
-                    )
-                )
-            self._callback_tails[owner] = task
-            self._callback_tasks.add(task)
-            task.add_done_callback(
-                lambda completed, owner=owner: self._finish_callback_task(
-                    owner,
-                    completed,
-                )
-            )
+        handlers = tuple(self._notification_handlers)
+        try:
+            allowed = self._notification_guard is None or self._notification_guard(notification)
+        except Exception:
+            allowed = False
+        if not allowed:
+            handlers = ()
+        self._dispatch_notification_handlers(notification, handlers)
 
         # Synchronous handlers (including the scoped fork watcher) must see
         # whether this identity was known *before* this notification. Record a
@@ -1516,6 +1518,54 @@ class CodexAppServerClient:
                 include_thread_subscription=True,
             )
 
+    @property
+    def account_epoch(self) -> int:
+        return self._account_epoch
+
+    def add_account_usage_handler(self, handler: NotificationHandler) -> None:
+        """Observe rate limits/auth invalidation in native receive order.
+
+        Synchronous observers update their cache inline; any returned async
+        invalidation broadcast is tracked without postponing later cache edits.
+        Authentication payloads are never passed to these handlers.
+        """
+        self._account_usage_handlers.add(handler)
+
+    def _dispatch_notification_handlers(
+        self, notification: dict[str, Any], handlers: tuple[NotificationHandler, ...],
+        *, ordered: bool = True,
+    ) -> None:
+        thread_id, _turn_id = _notification_scope(notification)
+        for handler in handlers:
+            owner = (handler, thread_id or "")
+            previous = self._callback_tails.get(owner) if ordered else None
+            if previous is None:
+                try:
+                    result = handler(notification)
+                except Exception:
+                    continue
+                if not inspect.isawaitable(result):
+                    # Preserve the original inline contract for synchronous
+                    # caches consumed by immediately following server requests.
+                    continue
+                task = asyncio.ensure_future(result)
+            else:
+                task = asyncio.create_task(
+                    self._invoke_notification_handler(
+                        handler,
+                        notification,
+                        previous,
+                    )
+                )
+            self._callback_tails[owner] = task
+            self._callback_tasks.add(task)
+            task.add_done_callback(
+                lambda completed, owner=owner: self._finish_callback_task(
+                    owner,
+                    completed,
+                )
+            )
+
     async def _invoke_notification_handler(
         self,
         handler: NotificationHandler,
@@ -1530,6 +1580,8 @@ class CodexAppServerClient:
                 # notification already received for the same handler.
                 pass
         try:
+            if self._notification_guard is not None and not self._notification_guard(notification):
+                return
             result = handler(notification)
         except Exception:
             return
@@ -1749,7 +1801,11 @@ class CodexAppServerClient:
                     isinstance(exc, CodexAppServerDisconnected)
                     and exc.request_sent
                 )
-                if ambiguous:
+                # Ephemeral forks disappear with their owning process. After
+                # explicit close there can be no late child left to delete;
+                # durable forks still require their usual ambiguity cleanup.
+                closing_ephemeral = payload.get("ephemeral") is True and self._closing
+                if ambiguous and not closing_ephemeral:
                     cleanup = asyncio.create_task(
                         self._delete_late_fork_child(late_children)
                     )
@@ -2628,6 +2684,7 @@ class CodexAppServerClient:
                     # continue before its delayed start response is read.
                     # Acceptance of that exact completed ID is proven; leave
                     # the handle bound to the newer live turn, not the reply.
+                    provisional.initial_turn_id = turn_id
                     return provisional
                 raise CodexAppServerProtocolError(
                     "turn/start response did not match its early notifications",
@@ -2635,6 +2692,7 @@ class CodexAppServerClient:
                     safe_to_retry=False,
                 )
             provisional.turn_id = turn_id
+            provisional.initial_turn_id = turn_id
             if not retain_thread_stream:
                 provisional._subscription.turn_id = turn_id
             return provisional
@@ -2696,6 +2754,7 @@ class CodexAppServerManager:
         process_factory: ProcessFactory | None = None,
         before_start: Callable[[], Awaitable[Any]] | None = None,
         server_request_handler: ServerRequestHandler | None = None,
+        notification_guard: Callable[[dict[str, Any]], bool] | None = None,
         initialize_params: dict[str, Any] | None = None,
         on_process_started: ProcessLifecycleHook | None = None,
         on_process_exited: ProcessLifecycleHook | None = None,
@@ -2715,6 +2774,7 @@ class CodexAppServerManager:
             process_factory=process_factory,
             before_start=before_start,
             server_request_handler=server_request_handler,
+            notification_guard=notification_guard,
             initialize_params=initialize_params,
             on_process_started=on_process_started,
             on_process_exited=on_process_exited,

package/server/codex_auth.py

@@ -1,7 +1,17 @@
 """Read-only native Codex authentication; custom keys belong to codex_provider."""
 from __future__ import annotations
 
+import base64
+from dataclasses import dataclass, field
+import hashlib
+import hmac
+import json
+import os
+from pathlib import Path
 import re
+import secrets
+import stat
+import tomllib
 
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse
@@ -11,6 +21,115 @@ MAX_BODY_BYTES = 8192
 MAX_API_KEY_CHARS = 4096
 AUTH_TIMEOUT_SECONDS = 30.0
 BUSY_MESSAGE = "Wait for Codex chats, goals, queued turns and Side chat requests to finish before changing authentication."
+HANDOFF_MESSAGE = (
+    "Refreshing Codex sign-in. Wait for this chat's running work, approvals, "
+    "goals and background terminals to finish, then retry. Your message has "
+    "not been sent to Codex."
+)
+_REVISION_KEY = secrets.token_bytes(32)
+_MAX_AUTH_BYTES = 128 * 1024
+
+
+@dataclass(frozen=True)
+class LoginRevision:
+    # Process-private change detection only, never authentication evidence.
+    # Do not put paths, account IDs, credentials or digests in repr/logs/API.
+    value: bytes = field(repr=False)
+
+
+def _bounded_file(path: Path) -> bytes:
+    fd = os.open(path, os.O_RDONLY | os.O_NONBLOCK)
+    with os.fdopen(fd, "rb") as stream:
+        before = os.fstat(stream.fileno())
+        if not stat.S_ISREG(before.st_mode) or before.st_size > _MAX_AUTH_BYTES:
+            raise ValueError("unsupported credential file")
+        raw = stream.read(_MAX_AUTH_BYTES + 1)
+        after = os.fstat(stream.fileno())
+        if len(raw) > _MAX_AUTH_BYTES or (before.st_mtime_ns, before.st_size) != (after.st_mtime_ns, after.st_size):
+            raise ValueError("credential file changed during read")
+        return raw
+
+
+def _native_login_config(env: dict[str, str], cwd: str) -> tuple[Path, dict]:
+    home = env.get("HOME")
+    location = env.get("CODEX_HOME")
+    if not location and not home:
+        raise ValueError("native home unavailable")
+    if location and location.startswith("~/"):
+        if not home:
+            raise ValueError("native home unavailable")
+        location = str(Path(home) / location[2:])
+    root = Path(location) if location else Path(home) / ".codex"
+    if not root.is_absolute():
+        root = Path(cwd) / root
+    try:
+        config = tomllib.loads(_bounded_file(root / "config.toml").decode())
+    except FileNotFoundError:
+        config = {}
+    return root, config
+
+
+def native_login_handoff_supported(env: dict[str, str], *, cwd: str) -> bool:
+    try:
+        _, config = _native_login_config(env, cwd)
+        # A process-only login cannot be recovered by starting a replacement.
+        # A malformed config must not retire an otherwise working generation.
+        return config.get("cli_auth_credentials_store", "file") in {"file", "keyring", "auto"}
+    except (OSError, ValueError, TypeError, RecursionError):
+        return False
+
+
+def native_login_revision(env: dict[str, str], *, cwd: str) -> LoginRevision | None:
+    """Conservative file-store signal; native Codex still owns all credentials.
+
+    Ignore rotating access/refresh tokens and last_refresh. OIDC auth_time is
+    stable across refresh but changes on an interactive authentication. Without
+    it we can detect an account switch, not prove a same-account re-login;
+    Recheck CLIs provides an explicit handoff for that case and keyring stores.
+    Missing/malformed files are not evidence of a new login. No secret survives
+    this bounded read except a process-keyed comparison digest.
+    """
+    try:
+        root, config = _native_login_config(env, cwd)
+        if config.get("cli_auth_credentials_store", "file") != "file":
+            return None  # Never infer keyring/auto/ephemeral state from a leftover file.
+        if any(env.get(key) for key in ("CODEX_ACCESS_TOKEN", "CODEX_API_KEY", "OPENAI_API_KEY", "OPENAI_IDENTITY_TOKEN_FILE")):
+            return None
+        data = json.loads(_bounded_file(root / "auth.json"))
+        if not isinstance(data, dict):
+            return None
+        key = data.get("OPENAI_API_KEY")
+        if isinstance(key, str) and key:
+            identity = ("apiKey", key)
+        else:
+            tokens = data.get("tokens")
+            if not isinstance(tokens, dict) or data.get("auth_mode") not in (None, "chatgpt"):
+                return None
+            encoded = tokens.get("id_token")
+            if not isinstance(encoded, str) or len(encoded) > 32768:
+                return None
+            parts = encoded.split(".")
+            if len(parts) != 3:
+                return None
+            claims = json.loads(base64.urlsafe_b64decode(parts[1] + "=" * (-len(parts[1]) % 4)))
+            if not isinstance(claims, dict):
+                return None
+            details = claims.get("https://api.openai.com/auth") or {}
+            if not isinstance(details, dict):
+                return None
+            account = tokens.get("account_id") or details.get("chatgpt_account_id")
+            subject = claims.get("sub")
+            if not isinstance(account, str) or not account or not isinstance(subject, str) or not subject:
+                return None
+            auth_time = claims.get("auth_time")
+            if auth_time is not None and (isinstance(auth_time, bool) or not isinstance(auth_time, int)):
+                return None
+            # Unverified claims are a change hint, never permission/account proof.
+            identity = ("chatgpt", account, subject, auth_time)
+        raw = json.dumps((str(root.resolve()), identity), separators=(",", ":")).encode()
+        return LoginRevision(hmac.new(_REVISION_KEY, raw, hashlib.sha256).digest())
+    except (OSError, ValueError, TypeError, RecursionError):
+        return None
 
 
 def capability(*, available: bool) -> dict:

package/server/codex_history_repair.py

@@ -157,7 +157,7 @@ def _native_stamp(path: Path) -> tuple[int, int, int, int]:
 
 
 def _native_records(path: Path, expected: tuple[int, int, int, int], budget: _NativeReadBudget,
-                    *, end: int | None = None):
+                    *, end: int | None = None, provider_source: bool = False):
     """Stream one fixed prefix; tool volume does not consume retained-key budget.
 
     A source proof needs only the prefix ending at its newest checkpoint. Never
@@ -181,7 +181,14 @@ def _native_records(path: Path, expected: tuple[int, int, int, int], budget: _Na
             if not line or len(line) > NATIVE_PROOF_LINE_BYTES or not line.endswith(b"\n"):
                 raise _Unproven()
             offset += len(line)
-            record = json.loads(line)
+            try:
+                record = json.loads(line)
+            except (ValueError, UnicodeDecodeError):
+                if not provider_source:
+                    raise
+                # The provider importer skips malformed records. Their exact
+                # bytes still participate in the checkpoint digest below.
+                record = {}
             if not isinstance(record, dict):
                 raise _Unproven()
             yield record, offset, line
@@ -229,6 +236,20 @@ def _public_assistant_item_id(event: dict) -> str | None:
     return item_id if public and isinstance(item_id, str) and 0 < len(item_id) <= 256 else None
 
 
+def _native_owned_turn_ids(event: dict) -> set[str]:
+    """One logical run can retain its initial input across native continuations."""
+    return {value for field in ("provider_turn_id", "provider_initial_turn_id")
+            if isinstance(value := event.get(field), str) and 0 < len(value) <= 256}
+
+
+def _native_assistant_item_owners(assistant_items: dict, completed_runs: set[str]) -> dict:
+    owners: dict = {}
+    for run, item_id, body_key in assistant_items:
+        if run in completed_runs:
+            owners.setdefault((item_id, body_key), set()).add(run)
+    return owners
+
+
 @dataclass
 class _SourceBudget:
     bytes_remaining: int
@@ -783,11 +804,12 @@ def _prove_native_replays(session_id: str, provider_id: str, events: Path, sourc
                     candidates.append(target)
         elif event.get("imported") is not True and event.get("backend") in (None, "codex"):
             if event.get("type") == "turn_finished" and event.get("backend") == "codex" and event.get("transport") == "app-server":
-                thread, turn = event.get("provider_thread_id"), event.get("provider_turn_id")
-                if isinstance(thread, str) and _PROVIDER_ID.fullmatch(thread) and isinstance(turn, str) and 0 < len(turn) <= 256:
-                    owned = owners.setdefault((thread, turn), set())
-                    retained += run not in owned
-                    owned.add(run)
+                thread = event.get("provider_thread_id")
+                if isinstance(thread, str) and _PROVIDER_ID.fullmatch(thread):
+                    for turn in _native_owned_turn_ids(event):
+                        owned = owners.setdefault((thread, turn), set())
+                        retained += run not in owned
+                        owned.add(run)
             kind = "user" if event.get("type") == "turn_started" else "assistant" if event.get("type") in ("assistant_text", "reasoning_summary", "turn_finished") else None
             body = event.get("prompt") if kind == "user" else event.get("result_text") if event.get("type") == "turn_finished" else event.get("text")
             if kind and isinstance(body, str) and body and len(body) <= 4 * 1024 * 1024:
@@ -868,10 +890,19 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
     compactions, candidate_assistants = {}, set()
     compaction_tracker = CodexCompactionSummaryTracker(thread)
     delivery_bodies, delivery_source_ids = {}, {}
+    completed_runs = {run for (owner_thread, _turn), runs in owners.items()
+                      if owner_thread == thread for run in runs}
+    assistant_item_owners = _native_assistant_item_owners({
+        (run, item_id, body_key): event
+        for (run, kind, body_key), events in native.items() if kind == "assistant"
+        for event in events if (item_id := _public_assistant_item_id(event)) is not None
+    }, completed_runs)
+    assistant_owner_evidence: dict = {}
+    assistant_source_turns: dict = {}
     allowed_header_owners, header_parents = {thread}, {}
     context_turn = None
     retained = 0
-    for record, offset, line in _native_records(source, stamp, budget, end=max(wanted)):
+    for record, offset, line in _native_records(source, stamp, budget, end=max(wanted), provider_source=True):
         payload = record.get("payload")
         if offset == len(line) or record.get("type") == "session_meta":
             if record.get("type") != "session_meta" or not isinstance(payload, dict):
@@ -922,6 +953,14 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
                 or not isinstance(timestamp, str) or not 0 < len(timestamp) <= 64):
             continue
         key = (turn, item["kind"], _text_key(item["text"]), item.get("source_text_sha256"))
+        if origin and item["kind"] == "assistant" and item.get("source_text_sha256") is None:
+            item_key = (origin["event_id"], _text_key(_native_assistant_text(item["text"])))
+            if item_key in assistant_item_owners:
+                assistant_source_turns.setdefault(item_key, set()).add(turn)
+                assistant_owner_evidence.setdefault(turn, []).append((offset, item_key))
+                retained += 1
+                if retained > MAX_KEYS:
+                    raise _Unproven()
         if origin and item["kind"] == "user" and any(run in deliveries.starts for run in owners.get((thread, turn), ())):
             ids = delivery_source_ids.setdefault(turn, set())
             if len(ids) < 2:
@@ -968,7 +1007,14 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
         if len(matches) != 1:
             continue
         key = next(iter(matches))
-        source_ids, owned_runs = canonical.get(key, {}), owners.get((thread, key[0]), set())
+        source_ids = canonical.get(key, {})
+        owned_runs = set(owners.get((thread, key[0]), set()))
+        # Older ledgers retained only the final continuation's turn ID. An
+        # exact public assistant item proves the earlier turn belongs to the
+        # same completed native run, without classifying any user wording.
+        for offset, item_key in assistant_owner_evidence.get(key[0], ()):
+            if offset <= end and len(assistant_source_turns[item_key]) == 1:
+                owned_runs.update(assistant_item_owners[item_key])
         # Compaction owns a particular source item and timestamp. Another
         # genuine answer with the same body in this turn is a distinct item.
         timestamp_origins = [origin for origin in source_ids.values() if origin["timestamp"] == timestamp]
@@ -1177,11 +1223,11 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
                 or not 0 < len(run) <= 256 or run.startswith("import_")):
                 continue
             if (event.get("type") == "turn_finished" and event.get("backend") == "codex"
-                and event.get("transport") == "app-server" and event.get("provider_thread_id") == provider_id
-                and isinstance(event.get("provider_turn_id"), str) and 0 < len(event["provider_turn_id"]) <= 256):
-                owned = owners.setdefault(event["provider_turn_id"], set())
-                owner_count += run not in owned
-                owned.add(run)
+                and event.get("transport") == "app-server" and event.get("provider_thread_id") == provider_id):
+                for turn_id in _native_owned_turn_ids(event):
+                    owned = owners.setdefault(turn_id, set())
+                    owner_count += run not in owned
+                    owned.add(run)
             kind = "user" if event.get("type") == "turn_started" else "assistant" if event.get("type") in ("assistant_text", "reasoning_summary", "turn_finished") else None
             body = event.get("prompt") if kind == "user" else event.get("result_text") if event.get("type") == "turn_finished" else event.get("text")
             wake_hash = _native_mailbox_wake_hash(event) if kind == "user" else None
@@ -1198,6 +1244,25 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
                         assistant_items[(run, item_id, key[1])] = event["id"]
             if native_count + owner_count + len(assistant_items) + deliveries.count > MAX_KEYS:
                 raise _Unproven()
+        assistant_item_owners = _native_assistant_item_owners(
+            assistant_items, {run for runs in owners.values() for run in runs},
+        )
+        assistant_source_turns: dict = {}
+        for item in items:
+            budget.check()
+            origin = item.get("provider_origin")
+            if (item.get("kind") != "assistant" or not isinstance(item.get("text"), str)
+                or item.get("source_text_sha256") is not None or not isinstance(origin, dict)
+                or origin.get("provider") != "codex" or origin.get("kind") != "assistant"
+                or origin.get("session_id", provider_id) != provider_id
+                or not isinstance(origin.get("turn_id"), str) or not 0 < len(origin["turn_id"]) <= 256):
+                continue
+            item_key = (origin.get("event_id"), _text_key(_native_assistant_text(item["text"])))
+            if item_key in assistant_item_owners:
+                assistant_source_turns.setdefault(item_key, set()).add(origin["turn_id"])
+        for item_key, turns in assistant_source_turns.items():
+            if len(turns) == 1:
+                owners.setdefault(next(iter(turns)), set()).update(assistant_item_owners[item_key])
         delivery_proofs = _prove_pending_async_deliveries(
             session_id, provider_id, items, source_path, root, sync_checkpoint, parse_item,
             previous_seq, owners, deliveries, budget,