@hienlh/ppm 0.20.1 → 0.20.2

package/src/providers/codex-app-server/codex-event-mapper.ts

@@ -2,6 +2,7 @@ import type { ChatEvent } from "../provider.interface.ts";
 import type { TurnUsage } from "../../shared/turn-usage.ts";
 import { redactTruncate } from "./codex-redact.ts";
 import { diffToOldNew, changeToToolUse } from "./codex-patch.ts";
+import { parseSubagentActivity, subagentToolResult, subagentToolUse } from "./codex-subagent-thread.ts";
 
 /** ThreadItem variants that are NOT tool calls (text/metadata). Everything else
  * is treated as a tool so nothing is ever silently hidden — known types get a
@@ -172,6 +173,11 @@ export function mapCodexEvent(notif: Notif, sessionId: string): ChatEvent[] {
     case "item/started": {
       const item = asObj(p.item) as Item;
       if (item.type === "contextCompaction") return [{ type: "system", subtype: "compacting" }];
+      // A spawned agent is a card, not a tool: its start and its completion are
+      // two records naming one thread, and the generic mapping rendered each as
+      // a card of its own with the raw item as its body.
+      const subagent = parseSubagentActivity(item);
+      if (subagent) return [subagentToolUse(subagent)];
       if (item.type && !NON_TOOL_ITEM_TYPES.has(item.type)) return [itemToToolUse(item)];
       return [];
     }
@@ -183,6 +189,11 @@ export function mapCodexEvent(notif: Notif, sessionId: string): ChatEvent[] {
     case "item/completed": {
       const item = asObj(p.item) as Item;
       if (item.type === "contextCompaction") return [{ type: "system", subtype: "compact_done" }];
+      const subagent = parseSubagentActivity(item);
+      // Answers the card opened at `started` — keyed on the thread, because the
+      // two records carry different item ids. The agent's own report is not on
+      // this record; the card picks it up when the transcript is read back.
+      if (subagent) return [subagent.done ? subagentToolResult(subagent) : subagentToolUse(subagent)];
       if (item.type && !NON_TOOL_ITEM_TYPES.has(item.type)) {
         // Image generation is announced before the picture exists: at `started`
         // there is no saved file and no revised prompt, so the call it produced

package/src/providers/codex-app-server/codex-history.ts

@@ -5,6 +5,11 @@ import { homedir } from "node:os";
 import { redactTruncate } from "./codex-redact.ts";
 import { parseApplyPatch, changeToToolUse } from "./codex-patch.ts";
 import { mapRolloutItem } from "./codex-rollout-items.ts";
+import { completeLines, parseLine, readRolloutHeader, type RolloutHeader } from "./codex-rollout-header.ts";
+import {
+  finalAssistantText, subagentToolResult, subagentToolUse, transcriptToEvents,
+  type SubagentTranscript,
+} from "./codex-subagent-thread.ts";
 
 /**
  * Independent parser for Codex rollout JSONL transcripts
@@ -18,30 +23,12 @@ import { mapRolloutItem } from "./codex-rollout-items.ts";
  * scaffolding).
  */
 
-interface RolloutLine {
-  timestamp?: string;
-  type?: string;
-  payload?: Record<string, unknown>;
-}
-
 /** Normalize a path for cross-platform comparison (case-insensitive on win32). */
 function normPath(p: string): string {
   const r = resolve(p);
   return process.platform === "win32" ? r.toLowerCase() : r;
 }
 
-/** Split into complete, newline-terminated lines only (drop a trailing partial). */
-function completeLines(text: string): string[] {
-  const lines = text.split("\n");
-  // If the text does not end in a newline, the last element is a partial line.
-  if (!text.endsWith("\n")) lines.pop();
-  return lines.filter((l) => l.trim() !== "");
-}
-
-function parseLine(line: string): RolloutLine | null {
-  try { return JSON.parse(line) as RolloutLine; } catch { return null; }
-}
-
 /** Extract plain text from a response_item message content array. */
 function contentToText(content: unknown): string {
   if (typeof content === "string") return content;
@@ -106,10 +93,20 @@ function fnOutputToToolResult(p: Record<string, unknown>): ChatEvent {
  * tool calls come from `response_item` function_call / function_call_output and
  * are nested into the assistant turn's `events` so the chat UI renders tool cards.
  */
-export function parseRolloutJsonl(text: string, opts?: { preCompact?: boolean }): ChatMessage[] {
+export function parseRolloutJsonl(
+  text: string,
+  opts?: {
+    preCompact?: boolean;
+    /** Reads a spawned thread's transcript so its card can nest it. */
+    loadSubagent?: (threadId: string) => SubagentTranscript | null;
+  },
+): ChatMessage[] {
   const messages: ChatMessage[] = [];
   let i = 0;
   let pendingEvents: ChatEvent[] = [];
+  // Kept so the completion can answer the card the spawn opened, with the
+  // report the child ended on.
+  const subagentTranscripts = new Map<string, SubagentTranscript | null>();
 
   // Newer codex records every finished step as an `item_completed` event AND
   // keeps the raw model exchange in `response_item` records. Both describe the
@@ -153,6 +150,15 @@ export function parseRolloutJsonl(text: string, opts?: { preCompact?: boolean })
           flushAssistant(mapped.text, ts);
         } else if (mapped.kind === "events") {
           pendingEvents.push(...mapped.events);
+        } else if (mapped.kind === "subagent") {
+          const { activity } = mapped;
+          if (!subagentTranscripts.has(activity.threadId)) {
+            subagentTranscripts.set(activity.threadId, opts?.loadSubagent?.(activity.threadId) ?? null);
+          }
+          const transcript = subagentTranscripts.get(activity.threadId) ?? null;
+          pendingEvents.push(activity.done
+            ? subagentToolResult(activity, transcript)
+            : subagentToolUse(activity, transcript));
         }
       } else if (p.type === "thread_rolled_back") {
         // codex doesn't truncate the rollout file on rollback/fork — it appends this
@@ -199,21 +205,10 @@ export function parseRolloutJsonl(text: string, opts?: { preCompact?: boolean })
   return messages;
 }
 
-/** Read the session_meta header (first record) from a rollout file. */
-function readSessionMeta(file: string): { id?: string; cwd?: string; timestamp?: string } | null {
+/** Read a rollout file's header (session_meta, plus its title when asked). */
+function readSessionMeta(file: string, opts?: { withTitle?: boolean }): RolloutHeader | null {
   try {
-    const text = readFileSync(file, "utf-8");
-    for (const line of completeLines(text)) {
-      const rec = parseLine(line);
-      if (rec?.type === "session_meta") {
-        const p = rec.payload ?? {};
-        return {
-          id: typeof p.id === "string" ? p.id : undefined,
-          cwd: typeof p.cwd === "string" ? p.cwd : undefined,
-          timestamp: typeof p.timestamp === "string" ? p.timestamp : rec.timestamp,
-        };
-      }
-    }
+    return readRolloutHeader(readFileSync(file, "utf-8"), opts);
   } catch { /* unreadable file → excluded (fail-closed) */ }
   return null;
 }
@@ -241,6 +236,12 @@ function threadIdFromName(file: string): string | null {
  * is included ONLY when its session_meta cwd resolves and matches `requestedCwd`
  * (normalized; case-insensitive on win32). Unattributable rollouts are excluded
  * — `~/.codex/sessions` holds every project's transcripts.
+ *
+ * A spawned subagent's rollout is excluded too. It carries the same cwd as the
+ * conversation that spawned it, so cwd alone let one subagent per spawn into the
+ * session list — each opening with no prompt and no ending, because a subagent's
+ * task never appears in its own transcript. Its work shows in the parent, on the
+ * Agent card for that spawn.
  */
 export function listCodexRollouts(
   sessionsDir: string,
@@ -253,9 +254,10 @@ export function listCodexRollouts(
   const sessions: SessionInfo[] = [];
 
   for (const file of files) {
-    const meta = readSessionMeta(file);
+    const meta = readSessionMeta(file, { withTitle: true });
     if (!meta?.cwd) continue;            // fail-closed: no cwd → exclude
     if (normPath(meta.cwd) !== target) continue;
+    if (meta.parentThreadId) continue;   // one step of another session, not a session
 
     const id = meta.id ?? threadIdFromName(file);
     if (!id) continue;
@@ -266,7 +268,7 @@ export function listCodexRollouts(
     sessions.push({
       id,
       providerId,
-      title: "Codex session",
+      title: meta.title ?? "Codex session",
       createdAt: meta.timestamp ?? new Date().toISOString(),
       updatedAt,
     });
@@ -287,20 +289,89 @@ export function listCodexRollouts(
  */
 export function findRolloutByThreadId(sessionsDir: string, threadId: string, requestedCwd?: string): string | null {
   const target = requestedCwd != null ? normPath(requestedCwd) : null;
-  for (const file of findRolloutFiles(sessionsDir)) {
-    if (threadIdFromName(file) !== threadId) {
-      const meta = readSessionMeta(file);
-      if (meta?.id !== threadId) continue;
-    }
-    if (target != null) {
-      const meta = readSessionMeta(file);
-      if (!meta?.cwd || normPath(meta.cwd) !== target) continue; // fail-closed
-    }
+  const files = findRolloutFiles(sessionsDir);
+  // The filename carries the thread id, so try those first and read nothing for
+  // the rest unless the name match is rejected. Reading a transcript to identify
+  // it costs megabytes, and resolving one is now per spawned subagent too.
+  const named = (f: string) => threadIdFromName(f) === threadId;
+  for (const file of [...files.filter(named), ...files.filter((f) => !named(f))]) {
+    const byName = named(file);
+    const meta = byName && target == null ? null : readSessionMeta(file);
+    if (!byName && meta?.id !== threadId) continue;
+    if (target != null && (!meta?.cwd || normPath(meta.cwd) !== target)) continue; // fail-closed
     return file;
   }
   return null;
 }
 
+/**
+ * Why a thread stopped, when it produced no message of its own.
+ *
+ * A subagent that dies on startup (a model its account cannot use, a transport
+ * failure) writes a transcript with nothing in it but the error, so without this
+ * its card in the parent is blank and says nothing about what went wrong.
+ */
+function terminalError(text: string): string {
+  for (const line of completeLines(text).reverse()) {
+    const rec = parseLine(line);
+    if (rec?.type !== "event_msg") continue;
+    const p = rec.payload ?? {};
+    if (p.type !== "task_complete" && p.type !== "error") continue;
+    const err = p.error;
+    const message = typeof err === "string" ? err
+      : (err && typeof err === "object" ? (err as Record<string, unknown>).message : undefined);
+    if (typeof message === "string" && message) return unwrapErrorJson(message);
+  }
+  return "";
+}
+
+/** Codex nests the upstream API error verbatim, as JSON, inside its own message. */
+function unwrapErrorJson(message: string): string {
+  if (!message.startsWith("{")) return message;
+  try {
+    const inner = (JSON.parse(message) as { error?: { message?: unknown } }).error?.message;
+    return typeof inner === "string" && inner ? inner : message;
+  } catch { return message; }
+}
+
+/** How deep a chain of spawned agents is followed into the parent's transcript. */
+const SUBAGENT_DEPTH = 2;
+
+/**
+ * Reader for a spawned thread's transcript, bound to the same sessions dir and
+ * the same fail-closed cwd guard as the conversation that spawned it.
+ *
+ * `seen` covers both the cycle a malformed pair of rollouts could describe and
+ * the same agent being named by its start and its completion.
+ */
+function subagentLoader(
+  sessionsDir: string,
+  requestedCwd: string | undefined,
+  seen: Set<string>,
+  depth: number,
+): (threadId: string) => SubagentTranscript | null {
+  return (threadId) => {
+    if (depth <= 0 || seen.has(threadId)) return null;
+    seen.add(threadId);
+    const file = findRolloutByThreadId(sessionsDir, threadId, requestedCwd);
+    if (!file) return null;
+    try {
+      const text = readFileSync(file, "utf-8");
+      const msgs = parseRolloutJsonl(text, {
+        loadSubagent: subagentLoader(sessionsDir, requestedCwd, seen, depth - 1),
+      });
+      const finalText = finalAssistantText(msgs) || terminalError(text);
+      const events = transcriptToEvents(msgs);
+      // An agent that died before saying anything is answered by its own error
+      // record, and the parent may never have written a completion for it — so
+      // the reason goes inside the card rather than waiting for a result event
+      // that is not coming.
+      if (events.length === 0 && finalText) events.push({ type: "text", content: finalText });
+      return { events, finalText };
+    } catch { return null; }
+  };
+}
+
 /** The compaction summary text if this rollout was compacted, else null. */
 function compactionSummary(text: string): string | null {
   for (const line of completeLines(text)) {
@@ -324,7 +395,9 @@ export function getRolloutMessages(sessionsDir: string, threadId: string, reques
   if (!file) return [];
   try {
     const text = readFileSync(file, "utf-8");
-    const msgs = parseRolloutJsonl(text);
+    const msgs = parseRolloutJsonl(text, {
+      loadSubagent: subagentLoader(sessionsDir, requestedCwd, new Set([threadId]), SUBAGENT_DEPTH),
+    });
     const summary = compactionSummary(text);
     if (summary !== null) {
       msgs.unshift({

package/src/providers/codex-app-server/codex-provider.ts

@@ -10,8 +10,19 @@ import type {
   UsageInfo,
 } from "../provider.interface.ts";
 import { configService } from "../../services/config.service.ts";
-import { setSessionMetadata, getSessionProjectPath, setSessionProvider, setSessionCodexAccount, getSessionCodexAccount } from "../../services/db.service.ts";
-import { resolveCodexAccountForSession, getCodexAccount, listCodexAccounts, peekCodexAccount } from "../../services/codex-account.service.ts";
+import { setSessionMetadata, getSessionProjectPath, setSessionProvider, setSessionCodexAccount, getSessionCodexAccount, getSessionTitles } from "../../services/db.service.ts";
+import {
+  resolveCodexAccountForSession,
+  getCodexAccount,
+  listCodexAccounts,
+  peekCodexAccount,
+  selectCodexAccount,
+  getAllCodexUsages,
+  codexUsageLevel,
+  type CodexAccount,
+} from "../../services/codex-account.service.ts";
+import { isCodexAccountUsageLimited, markCodexAccountUsageLimited } from "../../services/codex-account-cooldown.ts";
+import { isCodexUsageLimit, codexErrorMessage, parseCodexUsageLimitReset } from "./codex-usage-limit.ts";
 import { killProcessTree } from "../../services/windows-process-tree.ts";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -24,6 +35,7 @@ import { getOrFetchUsage, registerUsageSource } from "../../services/provider-us
 import { codexUsageSource } from "./codex-usage-source.ts";
 import { AMBIENT_ACCOUNT_KEY } from "../../services/provider-usage/usage-source.ts";
 import { redactTruncate } from "./codex-redact.ts";
+import { localizeRollout } from "./codex-rollout-transfer.ts";
 import {
   listCodexRollouts,
   findRolloutByThreadId,
@@ -54,16 +66,22 @@ const CODEX_SESSIONS_DIR = join(homedir(), ".codex", "sessions");
  * being served from the in-process transcript, and nothing on disk was ever
  * found for it.
  *
- * `sessionId` narrows to the bound account when there is one; without it the
- * caller gets every account, which is what listing a project's sessions needs.
+ * `sessionId` puts the bound account's directory FIRST, because a thread that
+ * has been continued on that account has its newest rollout there. It no longer
+ * restricts the search to it: an account switch — manual, or forced by a usage
+ * limit — leaves the conversation's history in the home of whichever account
+ * was serving when it was written. Searching the bound account alone is what
+ * made a switched session come back empty and silently start over as a new
+ * thread, since resume is only attempted when a rollout is found.
  */
 function codexSessionsDirs(sessionId?: string): string[] {
   const dirs: string[] = [];
   const boundId = sessionId ? getSessionCodexAccount(sessionId) : null;
-  const accounts = boundId
-    ? [getCodexAccount(boundId)].filter((a): a is NonNullable<typeof a> => a != null)
-    : listCodexAccounts();
-  for (const account of accounts) dirs.push(join(account.home, "sessions"));
+  const accounts = listCodexAccounts();
+  const ordered = boundId
+    ? [...accounts.filter((a) => a.id === boundId), ...accounts.filter((a) => a.id !== boundId)]
+    : accounts;
+  for (const account of ordered) dirs.push(join(account.home, "sessions"));
   dirs.push(CODEX_SESSIONS_DIR);
   return dirs;
 }
@@ -76,6 +94,29 @@ function fromCodexSessionsDirs<T>(sessionId: string | undefined, read: (dir: str
   }
   return null;
 }
+
+/**
+ * The rollout for a thread AND the sessions directory it was found in.
+ *
+ * The directory is what a plain path cannot tell us, and resuming needs it: a rollout
+ * belonging to another account has to be copied into the serving account's own home before
+ * codex will resolve it, and the copy has to keep its position relative to that directory.
+ */
+function locateRollout(
+  sessionId: string,
+  cwd: string,
+): { path: string; sessionsDir: string } | null {
+  for (const dir of codexSessionsDirs(sessionId)) {
+    const found = findRolloutByThreadId(dir, sessionId, cwd);
+    if (found) return { path: found, sessionsDir: dir };
+  }
+  return null;
+}
+
+/** Where the app-server on this account writes and looks for rollouts. */
+function sessionsDirForHome(codexHome?: string): string {
+  return codexHome ? join(codexHome, "sessions") : CODEX_SESSIONS_DIR;
+}
 const CLIENT_INFO = { name: "ppm", title: "PPM", version: "0.0.0" };
 const CAPABILITIES = { experimentalApi: true, requestAttestation: false, optOutNotificationMethods: null };
 const MODELS_CACHE_TTL = 5 * 60 * 1000;
@@ -118,6 +159,13 @@ interface LiveSession {
   interruptRequested?: boolean;
   /** Follow-ups waiting for the current turn, in the order they will be sent. */
   pendingTurns: QueuedTurn[];
+  /** A usage-limit rotation is underway: the old app-server is being torn down and
+   *  replaced by one running on another account. Everything the dying subprocess still
+   *  emits belongs to the turn being abandoned, so it is dropped rather than shown. */
+  rotating?: boolean;
+  /** The turn currently in flight, kept so a rotation can send it again on the new
+   *  account. Cleared when the turn ends — there is then nothing to replay. */
+  lastTurnInput?: { message: string; opts?: SendMessageOpts };
 }
 
 /** A follow-up held back because a turn was already running. */
@@ -281,6 +329,11 @@ export class CodexAppServerProvider implements AIProvider {
         sessions.push(s);
       }
     }
+    // A title the user set by hand outranks the one derived from the opening
+    // prompt, and it is the only place a renamed codex session is recorded.
+    const customTitles = getSessionTitles(sessions.map((s) => s.id));
+    for (const s of sessions) s.title = customTitles[s.id] ?? s.title;
+
     // Backfill provider ownership so reopening a pre-existing codex thread routes
     // to codex (not the default provider) even after a restart.
     //
@@ -328,7 +381,15 @@ export class CodexAppServerProvider implements AIProvider {
     this.startTurn(live, content, opts);
   }
 
-  private startTurn(live: LiveSession, message: string, opts?: SendMessageOpts): void {
+  /**
+   * Send a turn on the live thread.
+   *
+   * `replay` marks the same turn being sent again on a different account after a usage
+   * limit. It skips the transcript append only: the user typed the message once, and a
+   * second entry would both show it twice and shift every later `rollout-N` id, which
+   * fork anchors resolve against.
+   */
+  private startTurn(live: LiveSession, message: string, opts?: SendMessageOpts, replay = false): void {
     if (!live.threadId) return;
     // One turn at a time — anything sent now would be dropped without a trace.
     // `now` additionally cuts the running turn short so this one answers next.
@@ -351,7 +412,8 @@ export class CodexAppServerProvider implements AIProvider {
       });
       return;
     }
-    live.transcript.push({ id: nextRolloutId(live), role: "user", content: message, timestamp: new Date().toISOString() });
+    if (!replay) live.transcript.push({ id: nextRolloutId(live), role: "user", content: message, timestamp: new Date().toISOString() });
+    live.lastTurnInput = { message, opts };
     live.currentAssistant = "";
     live.currentEvents = [];
     // Codex takes an image as a path, never as a payload, so the uploaded copy is what it
@@ -371,7 +433,12 @@ export class CodexAppServerProvider implements AIProvider {
       const id = (res as { turn?: { id?: string } })?.turn?.id;
       if (id && !live.activeTurnId) this.setActiveTurn(live, id);
     }).catch((err) => {
-      if (!live.client.isClosed) live.channel.push({ type: "error", message: redactTruncate((err as Error)?.message ?? String(err), 256) });
+      const reason = (err as Error)?.message ?? String(err);
+      // A quota refusal can come back as the rejection of the request itself rather than
+      // as an `error` notification, and it is the same situation either way — move the
+      // turn to an account that still has room instead of showing the refusal.
+      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason)) return;
+      if (!live.client.isClosed) live.channel.push({ type: "error", message: redactTruncate(reason, 256) });
       // No turn is running, so nothing will report `turn/completed` — release the
       // queue here or every later follow-up waits on a turn that never existed.
       this.endTurn(live);
@@ -410,10 +477,195 @@ export class CodexAppServerProvider implements AIProvider {
     live.turnInFlight = false;
     live.activeTurnId = null;
     live.interruptRequested = false;
+    live.lastTurnInput = undefined;
     const next = live.pendingTurns.shift();
     if (next) this.startTurn(live, next.message, next.opts);
   }
 
+  // ── Usage-limit rotation ──
+
+  /**
+   * Take over a turn Codex refused for an exhausted quota, if another account can serve it.
+   *
+   * Answers synchronously so the caller knows, before it decides what to show, whether the
+   * refusal is being handled or has to be reported. The rotation itself is asynchronous —
+   * it respawns a subprocess and resumes the thread — but whether one is possible is a
+   * question about which accounts exist, which needs no I/O.
+   *
+   * Returns false when nothing else could serve the turn, and the refusal then reaches the
+   * user untouched. That is the honest outcome: an error saying the quota is spent is worth
+   * more than a silent retry on the account that just said so.
+   */
+  private beginRotation(live: LiveSession, reason: string): boolean {
+    const threadId = live.threadId;
+    if (!threadId || live.rotating) return false;
+    const currentId = getSessionCodexAccount(threadId);
+    const candidates = listCodexAccounts().filter(
+      (a) => a.status !== "disabled" && a.id !== currentId && !isCodexAccountUsageLimited(a.id),
+    );
+    if (candidates.length === 0) return false;
+    live.rotating = true;
+    void this.rotateAccount(live, threadId, currentId, reason);
+    return true;
+  }
+
+  /** Park the spent account, move the session onto a fresh one, and send the turn again. */
+  private async rotateAccount(
+    live: LiveSession,
+    threadId: string,
+    currentId: string | null,
+    reason: string,
+  ): Promise<void> {
+    const pending = live.lastTurnInput;
+    const reset = parseCodexUsageLimitReset(reason);
+    if (currentId) markCodexAccountUsageLimited(currentId, reset?.atMs);
+
+    let next: CodexAccount | null = null;
+    try {
+      // Usage picks the emptiest of the remaining accounts rather than merely the next one,
+      // so a rotation forced by a limit does not land on an account that is nearly at its own.
+      const usages = await getAllCodexUsages();
+      next = selectCodexAccount({
+        usageOf: (id) => codexUsageLevel(usages[id]),
+        ...(currentId ? { exclude: [currentId] } : {}),
+      });
+    } catch {
+      next = selectCodexAccount(currentId ? { exclude: [currentId] } : undefined);
+    }
+
+    if (!next) { this.abandonRotation(live, reason, reset?.text); return; }
+
+    console.warn(`[codex] session=${threadId} usage limit — switching to ${next.id} (${next.label})`);
+    live.channel.push({
+      type: "account_retry",
+      reason: "Usage limit reached — switching account",
+      accountId: next.id,
+      accountLabel: next.label,
+    });
+
+    try {
+      await this.respawnOn(live, threadId, next);
+    } catch (e) {
+      console.error(`[codex] session=${threadId} rotation to ${next.id} failed: ${redactTruncate((e as Error)?.message, 200)}`);
+      this.abandonRotation(live, reason, reset?.text);
+      return;
+    }
+
+    live.rotating = false;
+    // The refused turn never reached `turn/completed`, so the flags it set are still on.
+    live.turnInFlight = false;
+    live.activeTurnId = null;
+    live.interruptRequested = false;
+    if (pending) this.startTurn(live, pending.message, pending.opts, true);
+    else this.endTurn(live);
+  }
+
+  /** No account could take the turn — report the refusal and close the turn out. */
+  private abandonRotation(live: LiveSession, reason: string, resetText?: string): void {
+    live.rotating = false;
+    const suffix = resetText ? ` Try again ${resetText}.` : "";
+    live.channel.push({
+      type: "error",
+      message: `${redactTruncate(reason, 512)}${suffix} Add another account in Settings → Accounts, or wait for the reset.`,
+    });
+    live.channel.push({ type: "done", sessionId: live.threadId ?? "", resultSubtype: "error_during_execution" });
+    this.endTurn(live);
+  }
+
+  /**
+   * Put this session's app-server on another account, keeping the session itself intact.
+   *
+   * The subprocess is replaced, not the `LiveSession`: the caller of `sendMessage` is
+   * iterating this session's channel, and handing it a new one would end its stream mid-turn
+   * and leave the rest of the answer with nobody listening. Transcript, history and pending
+   * follow-ups all survive for the same reason.
+   *
+   * The outgoing client's handlers are cleared before it is closed. `close()` only asks the
+   * process to exit, so its `close` event lands well after this returns — by which time
+   * `rotating` is off again, and the inherited `onClose` would tear down the session that
+   * had just been repaired.
+   */
+  private async respawnOn(live: LiveSession, threadId: string, account: CodexAccount): Promise<void> {
+    const old = live.client;
+    old.onNotification(() => {});
+    old.onServerRequest(() => {});
+    old.onClose(() => {});
+    const pid = old.pid;
+    const proc = old.process;
+    old.close();
+    if (process.platform === "win32" && pid) killProcessTree(pid);
+    else if (proc) setTimeout(() => { try { proc.kill("SIGKILL"); } catch { /* dead */ } }, 2000).unref?.();
+
+    // Written before the rollout lookup so the new account's own directory is searched
+    // first — on a second rotation that is where the freshest history sits.
+    setSessionCodexAccount(threadId, account.id);
+
+    const client = new CodexJsonRpcClient();
+    client.onNotification((n) => this.handleNotification(live, n));
+    client.onServerRequest((r) => this.handleServerRequest(live, r));
+    client.onClose(() => this.handleClose(live));
+    client.start({ cwd: live.cwd, codexHome: account.home });
+    live.client = client;
+
+    await client.request("initialize", { clientInfo: CLIENT_INFO, capabilities: CAPABILITIES }, CONTROL_REQUEST_TIMEOUT_MS);
+    client.notify("initialized");
+
+    const resumeBase = {
+      cwd: live.cwd,
+      sandbox: live.permission.sandbox,
+      approvalPolicy: live.permission.approvalPolicy,
+      ...(live.model ? { model: live.model } : {}),
+    };
+    const found = locateRollout(threadId, live.cwd);
+    if (found) {
+      await this.resumeThread(client, threadId, found, account.home, resumeBase);
+      return;
+    }
+    // No rollout yet means the limit hit the very first turn, before codex had written one.
+    // There is nothing to resume, so the thread starts fresh — and it comes back under a
+    // new id, which every map keyed by the old one has to learn about or the next turn is
+    // sent to a thread this app-server has never heard of.
+    const started = await client.request("thread/start", resumeBase);
+    const newId = extractThreadId(started);
+    if (!newId || newId === threadId) return;
+    live.threadId = newId;
+    this.live.set(newId, live);
+    const meta = this.sessions.get(threadId);
+    if (meta) { this.sessions.delete(threadId); meta.id = newId; this.sessions.set(newId, meta); }
+    setSessionMetadata(newId, meta?.projectName, live.cwd);
+    setSessionProvider(newId, this.id);
+    setSessionCodexAccount(newId, account.id);
+    live.channel.push({ type: "session_migrated", oldSessionId: threadId, newSessionId: newId });
+  }
+
+  /**
+   * Resume a thread from the rollout file we located, wherever it lives.
+   *
+   * The `path` matters because a rollout is written inside the CODEX_HOME of whichever
+   * account served the turn, and this app-server is running on the account serving the
+   * session NOW. Asked by thread id alone, it searches only its own home and answers "no
+   * rollout found for thread id …" for a conversation that plainly exists — which is how
+   * an account switch used to lose the history and open a brand-new thread instead.
+   *
+   * The id-only form is kept as a fallback for a codex build that predates `path`: there
+   * the argument is rejected outright, and a resume that can still work by id should not
+   * be downgraded into a new thread over a field name.
+   */
+  private async resumeThread(
+    client: CodexJsonRpcClient,
+    threadId: string,
+    found: { path: string; sessionsDir: string },
+    codexHome: string | undefined,
+    resumeBase: Record<string, unknown>,
+  ): Promise<unknown> {
+    const target = sessionsDirForHome(codexHome);
+    const path = localizeRollout(found.path, found.sessionsDir, target);
+    if (path !== found.path) {
+      console.log(`[codex] thread=${threadId} rollout copied into the serving account's home to resume`);
+    }
+    return client.request("thread/resume", { threadId, path, ...resumeBase });
+  }
+
   private async connect(sessionId: string, opts?: SendMessageOpts): Promise<LiveSession> {
     const meta = this.sessions.get(sessionId);
     const cwd = meta?.projectPath || getSessionProjectPath(sessionId) || process.cwd();
@@ -445,12 +697,12 @@ export class CodexAppServerProvider implements AIProvider {
     const resumeBase = { cwd, sandbox: permission.sandbox, approvalPolicy: permission.approvalPolicy, ...(model ? { model } : {}) };
     // Only treat as a resume when a rollout for this id is attributable to THIS
     // project (fail-closed cwd guard) — never resume another project's thread.
-    const isResume = !!fromCodexSessionsDirs(sessionId, (d) => findRolloutByThreadId(d, sessionId, cwd));
-    const result = isResume
-      ? await client.request("thread/resume", { threadId: sessionId, ...resumeBase })
+    const found = locateRollout(sessionId, cwd);
+    const result = found
+      ? await this.resumeThread(client, sessionId, found, account?.home, resumeBase)
       : await client.request("thread/start", resumeBase);
 
-    const threadId = extractThreadId(result) ?? (isResume ? sessionId : null);
+    const threadId = extractThreadId(result) ?? (found ? sessionId : null);
     if (!threadId) throw new Error("codex thread/start returned no thread id");
     live.threadId = threadId;
 
@@ -480,6 +732,16 @@ export class CodexAppServerProvider implements AIProvider {
   }
 
   private handleNotification(live: LiveSession, notif: JsonRpcNotification): void {
+    // A quota refusal is an ordinary `error` notification, so it has to be recognised
+    // before the mapper turns it into a plain error card in front of the user.
+    if (notif.method === "error" && !live.rotating) {
+      const reason = codexErrorMessage(notif.params);
+      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason)) return;
+    }
+    // Mid-rotation the subprocess behind this session is being replaced. Anything it still
+    // emits describes the turn that was refused — including its `turn/completed`, which
+    // would close the turn the caller is about to be given a second time.
+    if (live.rotating) return;
     if (notif.method === "item/agentMessage/delta") {
       const d = (notif.params as { delta?: string })?.delta;
       if (typeof d === "string") live.currentAssistant += d;