@bridge4dev/runner 0.42.1 → 0.44.2

package/dist/adapters/codex.js

@@ -153,6 +153,16 @@ class CodexSession {
     threadId = null;
     threadModel = null;
     activeTurnId = null;
+    /**
+     * Did this turn put anything on the wire before it broke, and was any of it
+     * beyond taking back? (#252, #257)
+     *
+     * The Claude adapter counts the same two facts for the same reason: a failure
+     * that arrives after six rounds of tools cannot be answered by re-sending the
+     * turn. Reset in `beginTurnWork`, called wherever a turn starts.
+     */
+    turnProduced = false;
+    turnIrreversible = false;
     /**
      * Last turn this thread finished (ticket #126).
      *
@@ -1099,6 +1109,9 @@ class CodexSession {
             }
             case 'turn/started': {
                 this.activeTurnId = str(params['turnId']) ?? str(asRecord(params['turn'])['id']) ?? null;
+                // #252: Codex announces its turns, so this is the exact boundary. Any
+                // later and one turn's «work was done» would veto every retry after it.
+                this.beginTurnWork();
                 return;
             }
             case 'turn/completed': {
@@ -1276,6 +1289,8 @@ class CodexSession {
             case 'commandExecution': {
                 const command = str(item['command']) ?? '';
                 if (!done) {
+                    // #252/#257: what separates «send the turn again» from «resume it».
+                    this.noteWork(command);
                     this.emit({
                         type: 'tool',
                         phase: 'use',
@@ -1384,16 +1399,28 @@ class CodexSession {
             const usedPercent = num(window['usedPercent'] ?? window['used_percent']);
             if (usedPercent === undefined)
                 continue;
-            const minutes = num(window['windowMinutes'] ?? window['window_minutes']) ?? null;
-            // Live 2026-08-15: Codex sent a percentage with NO length, so the label
-            // fell back to «Limit window» — true but useless. The slot itself carries
-            // the answer on every ChatGPT plan: `primary` is the short window,
-            // `secondary` the weekly one. Used only when the minutes are missing, so
-            // a provider that does state them still wins.
+            // `windowDurationMins` is the name codex-cli 0.147.0 actually sends —
+            // captured from a live `account/rateLimits/updated` on 2026-08-16:
+            //
+            //   primary:   {usedPercent: 4, windowDurationMins: 10080, resetsAt: 1787221437}
+            //   secondary: null
+            //
+            // The two older spellings are kept behind it, not in front: a Codex that
+            // still sends them keeps working, and the current one stops being read as
+            // «length unknown». That misreading is what made the panel label a WEEKLY
+            // window «5 hours» — the number was right and the heading was not.
+            const minutes = num(window['windowDurationMins'] ?? window['windowMinutes'] ?? window['window_minutes']) ??
+                null;
             // Only when the length is ABSENT. A stated length we do not recognise is
             // information — 43 200 minutes is a monthly window, and calling it «5
             // hours» because it arrived first would be worse than admitting we have
             // no name for it.
+            //
+            // The slot fallback stays for exactly that case, but it is now the last
+            // resort rather than the usual path. And note what the live payload shows:
+            // `primary` is NOT reliably the short window. Here it is the weekly one
+            // and `secondary` is null, so guessing by slot was wrong in the only case
+            // we have ever observed.
             const key = minutes === null
                 ? slot === 'primary'
                     ? 'five_hour'
@@ -1403,7 +1430,12 @@ class CodexSession {
                 key,
                 windowMinutes: minutes,
                 usedPercent: clampPercent(usedPercent),
-                resetsAt: str(window['resetsAt'] ?? window['resets_at']) ?? null,
+                // Epoch SECONDS on the wire, not an ISO string — reading it with `str()`
+                // returned undefined for every snapshot ever received, which is why no
+                // Codex window has ever shown a reset time. The string form is still
+                // accepted in case a future version switches. Same fact, two encodings,
+                // one place that knows it — exactly as the Claude adapter already does.
+                resetsAt: codexResetsAt(window['resetsAt'] ?? window['resets_at']),
             });
         }
         this.rateLimitWindows = windows.sort((a, b) => (a.windowMinutes ?? Number.MAX_SAFE_INTEGER) - (b.windowMinutes ?? Number.MAX_SAFE_INTEGER));
@@ -1438,9 +1470,36 @@ class CodexSession {
      * calls a human instead. Guessing a time here is the one outcome worth
      * avoiding: waking early burns a retry and changes nothing.
      */
+    /** A new turn is starting — forget what the previous one did (#252). */
+    beginTurnWork() {
+        this.turnProduced = false;
+        this.turnIrreversible = false;
+    }
+    /**
+     * Record a command as work that happened, and judge whether it can be undone.
+     *
+     * The same blunt list as the Claude adapter: writing git subcommands only.
+     * Read-only git is excluded deliberately — the agent runs `git status` all day
+     * and treating that as a write would suppress nearly every retry.
+     */
+    noteWork(command) {
+        this.turnProduced = true;
+        if (this.turnIrreversible)
+            return;
+        if (/\bgit\s+(commit|push|tag|merge|rebase|reset|revert|cherry-pick)\b/.test(command)) {
+            this.turnIrreversible = true;
+        }
+    }
     rateLimitRefusal(error) {
+        // The machine-readable cause FIRST. Codex 0.147.0 says `usageLimitExceeded`
+        // — Exceeded, not Reached — so not one of the four substrings below ever
+        // matched it, and the auto-pause never armed on this agent at all: a refused
+        // turn went to FAILED instead of sleeping until the window reopened.
+        // Demonstrated by test, 2026-08-16, not inferred.
+        const code = str(asRecord(error)['codexErrorInfo']);
         const haystack = JSON.stringify(error).toLowerCase();
-        const refused = haystack.includes('ratelimitreached') ||
+        const refused = code === 'usageLimitExceeded' ||
+            haystack.includes('ratelimitreached') ||
             haystack.includes('rate_limit_reached') ||
             haystack.includes('usage_limit_reached') ||
             haystack.includes('usagelimitreached');
@@ -1472,6 +1531,13 @@ class CodexSession {
             const blocked = this.rateLimitRefusal(error);
             if (blocked)
                 this.emitRateLimits(blocked);
+            // #252: the machine-readable cause, beside the sentence. `codexErrorInfo`
+            // is Codex's own enum (`usageLimitExceeded`, `httpConnectionFailed`,
+            // `responseStreamConnectionFailed`, `contextWindowExceeded`, …) and it is
+            // the ONLY thing allowed to open the door to an automatic retry — the
+            // message next to it is prose, and prose can be written by agents.
+            const failureCode = str(error['codexErrorInfo']);
+            const failureStatus = error['httpStatusCode'];
             this.emit({
                 type: 'turn_end',
                 ok: false,
@@ -1480,6 +1546,10 @@ class CodexSession {
                 // one line earlier would ring into a dead row and throw the person's
                 // queued words away instead of sending them.
                 ...(blocked ? { limitBlocked: true } : {}),
+                ...(failureCode !== undefined ? { failureCode } : {}),
+                ...(typeof failureStatus === 'number' ? { failureStatus } : {}),
+                ...(this.turnProduced ? { produced: true } : {}),
+                ...(this.turnIrreversible ? { irreversible: true } : {}),
             });
             return;
         }
@@ -1867,6 +1937,31 @@ function truncateRecord(value) {
     }
     return out;
 }
+/**
+ * When a Codex window resets → ISO, or null if it did not say.
+ *
+ * Epoch SECONDS on the wire, captured live from codex-cli 0.147.0 on 2026-08-16:
+ * `resetsAt: 1787221437` is 2026-08-20. Read as a string it was silently dropped,
+ * which is why no Codex window has ever shown a reset time and why #258 had
+ * nothing to schedule a wake-up from on this agent.
+ *
+ * The range check is not decoration. A clock built from a misread number is
+ * worse than no clock at all: milliseconds mistaken for seconds would promise a
+ * reset in the year 58600, and #258 would arm a timer on it. Outside the range,
+ * we say we do not know — which is the honest answer and the safe one.
+ */
+export function codexResetsAt(raw) {
+    if (typeof raw === 'string' && raw) {
+        const parsed = Date.parse(raw);
+        return Number.isNaN(parsed) ? null : new Date(parsed).toISOString();
+    }
+    if (typeof raw !== 'number' || !Number.isFinite(raw))
+        return null;
+    // 2001-09-09 … 2286-11-20 in epoch seconds.
+    if (raw < 1_000_000_000 || raw > 9_999_999_999)
+        return null;
+    return new Date(raw * 1000).toISOString();
+}
 function stringifyMcpResult(item) {
     const errorMessage = str(asRecord(item['error'])['message']);
     if (errorMessage)

package/dist/adapters/error-policy.d.ts

@@ -0,0 +1,178 @@
+/**
+ * What a failed turn is allowed to do next — as DATA, not as branching (#252, #257).
+ *
+ * It lives beside `rate-limits.ts` and for the same reason: two CLIs describe the
+ * same class of accident in two vocabularies, a third provider is expected, and
+ * one table is easier to audit than two adapters' worth of `if`.
+ *
+ * ## How to read the table
+ *
+ * Every cause either CLI is known to report has its own row, including the ones
+ * that are never retried. Owner's instruction, 2026-08-16: the config should list
+ * them all with an explicit `retry: true | false`, so the answer to «why did the
+ * session not pick itself back up» is one line in one file rather than an absence.
+ *
+ * The dividing line is **whose fault it is**. Automatic retry is for failures that
+ * belong to the provider's own servers and have nothing to do with what the user
+ * asked for — a busy cluster, a 500, a dropped connection. Everything that depends
+ * on the account or the request — a dead key, an empty wallet, a refused policy, a
+ * context that no longer fits — is `retry: false` and stops the session, because
+ * asking again produces the same answer while burning tokens and, for policy and
+ * billing, sending a bad signal toward the account.
+ *
+ * ## The unit is the TURN, not the request
+ *
+ * The tempting table — «529 and 5xx are retryable» — is written for a single HTTP
+ * call. Ours is a turn: one turn is many calls, and by the time a 529 surfaces the
+ * agent may have run six rounds of tools, with a `git commit` and a `git push`
+ * already on disk. So a row here is a PERMISSION, never an instruction: the caller
+ * still has to ask «did this turn already do something» and narrow it. `refine()`
+ * below is that step, and it is not optional.
+ *
+ * ## Why codes and not sentences
+ *
+ * Both CLIs hand us a machine-readable cause and the runner used to throw it away.
+ * Sentences are not matched at all — see the note on `match`. We already have a
+ * scar from matching prose: `isAuthError` had to be strengthened because a bare
+ * `401` matched an MCP server's error and «unauthorized» contains «auth».
+ *
+ * ## Unknown means STOP
+ *
+ * A code that matches no row behaves exactly as it does today: the session stops
+ * and calls a human. The costs are wildly asymmetric — a wrong STOP costs one
+ * click, a wrong RETRY costs a second `git push`, a duplicated MCP write, tokens
+ * paid twice, and a transcript with duplicate tool_use ids (which is itself a 400
+ * that no retry can clear). It also makes an endless retry loop impossible by
+ * construction rather than by a counter someone might raise later.
+ */
+/** Verified against Claude Code CLI 2.1.233 and codex-cli 0.147.0 on 2026-08-16. */
+export type RetryBucket = 
+/** Nothing ran. The same turn may be sent again. */
+'retry'
+/** Work was partly done. Resume it; never re-send the prompt. */
+ | 'continue'
+/** A repeat cannot help. Stop and tell the person. */
+ | 'stop';
+export type BackoffProfile = 'standard' | 'slow';
+export interface ErrorRule {
+    /** Stable id — also the key the «same failure twice» guard compares. */
+    id: string;
+    provider: 'claude' | 'codex';
+    match: {
+        /** The provider's own machine-readable cause. */
+        codeIn?: readonly string[];
+        /** HTTP status, when the provider reported one. */
+        statusFrom?: number;
+        statusTo?: number;
+    };
+    /**
+     * The switch: may this cause EVER be retried automatically?
+     *
+     * `false` means today's behaviour — the session stops and asks for a person.
+     * Turning one on is a deliberate act with a reason written in `note`.
+     */
+    retry: boolean;
+    /** Read only when `retry` is true. */
+    bucket?: Exclude<RetryBucket, 'stop'>;
+    attempts?: number;
+    backoff?: BackoffProfile;
+    /**
+     * `false` → the row is INERT: counted, never acted on.
+     *
+     * How a provider we have not run yet gets into the table safely. Gemini and the
+     * Chinese providers are expected next, and several of them answer with HTTP 200
+     * and put the failure in the body, so their rows must not go live on a guess.
+     */
+    verified: boolean;
+    note: string;
+}
+/**
+ * The one place a provider is added, and the one place a retry is switched on.
+ *
+ * First match wins, so named causes precede status ranges.
+ */
+export declare const ERROR_RULES: readonly ErrorRule[];
+export interface FailureSignal {
+    provider: 'claude' | 'codex';
+    /**
+     * The provider's machine-readable cause — `assistant.error` for Claude,
+     * `codexErrorInfo` for Codex.
+     *
+     * **A decision can only start here or at `status`.** If both are absent the
+     * answer is `stop`, no matter what the text says.
+     */
+    code?: string | null;
+    /** HTTP status, when the provider reported one. */
+    status?: number | null;
+    /**
+     * The CLI's own sentence about the failure.
+     *
+     * Read in ONE direction: it can turn a `retry` into a `continue`, and it can
+     * never turn anything into a `retry`.
+     */
+    text?: string | null;
+    /** Did the turn emit anything at all before it broke — text, thinking, a tool call? */
+    produced?: boolean;
+    /** Did the turn run something a repeat cannot take back — git, or a write through MCP? */
+    irreversible?: boolean;
+}
+export interface RetryDecision {
+    bucket: RetryBucket;
+    attempts: number;
+    backoff: BackoffProfile;
+    /** Which row decided, or `null` when nothing matched and the default applied. */
+    ruleId: string | null;
+}
+/**
+ * What may this failure do next?
+ *
+ * First match wins. A row that is inert (`verified: false`) or switched off
+ * (`retry: false`) resolves to `stop` — but still reports its id, so the feed and
+ * the logs can say WHICH known cause stopped the session rather than «unknown».
+ */
+export declare function classifyFailure(signal: FailureSignal): RetryDecision;
+/**
+ * The ceiling no row can raise: total automatic retries in one session's life.
+ *
+ * Every other guard depends on the table being right. This one does not — it is
+ * arithmetic. If a code were misclassified, if a provider started answering with
+ * a cause we read wrongly, if two mechanisms both decided to retry, the session
+ * still cannot spin: after this many attempts it stops and asks for a person,
+ * exactly as it does today.
+ *
+ * Reset when a HUMAN sends a message, on the same reasoning as `clearAutoResume`:
+ * somebody typing into the session is the clearest possible evidence that the
+ * work is on track again.
+ */
+export declare const MAX_RETRIES_PER_SESSION = 12;
+/**
+ * Has this exact failure already been retried, and come straight back?
+ *
+ * Cheap insurance against a deterministic failure wearing a transient face — a
+ * context overflow surfacing as a 500, a malformed transcript that will fail
+ * identically forever. One repeat of the same row is enough to conclude the
+ * repeat is not helping, and spending the remaining attempts proves nothing.
+ */
+export declare function isRepeatOfSameFailure(previousRuleId: string | null | undefined, decision: RetryDecision): boolean;
+/**
+ * How long to wait before attempt `attempt` (1-based).
+ *
+ *   standard: max(10s, U(0, min(300s, 30s · 2^(n-1))))
+ *   slow:     max(30s, U(0, min(600s, 60s · 2^(n-1))))
+ *
+ * Full jitter, with a floor. The floor matters: pure full jitter can collapse to
+ * nearly zero, and a zero-length wait before restarting a process is pointless —
+ * the process takes longer than that to come up.
+ *
+ * The base is tens of seconds rather than one, because our attempt is not an HTTP
+ * request: it is a process re-reading a conversation, costing seconds and input
+ * tokens. By the time we see the failure at all, the CLI has already run its own
+ * retry ladder — `api_retry` reports up to ten of them — so answering that with
+ * another try one second later would just be noise.
+ *
+ * Jitter is not decoration: one machine runs several sessions and there are many
+ * machines, all watching the same API. Without it a recovering provider gets a
+ * synchronised volley from the whole fleet.
+ */
+export declare function retryDelayMs(profile: BackoffProfile, attempt: number, random?: () => number): number;
+//# sourceMappingURL=error-policy.d.ts.map