@hienlh/ppm 0.20.1 → 0.20.2

package/src/providers/codex-app-server/codex-rollout-header.ts

@@ -0,0 +1,99 @@
+import { mapRolloutItem } from "./codex-rollout-items.ts";
+
+/**
+ * Line primitives for a codex rollout JSONL, plus the header a session list
+ * needs: which project the thread ran in, whether it is a thread of its own,
+ * and what to call it.
+ *
+ * Kept apart from the transcript parser because listing reads every rollout in
+ * the tree while parsing reads one — the listing path must be able to stop at
+ * the first few records instead of walking a multi-megabyte transcript.
+ */
+
+export interface RolloutLine {
+  timestamp?: string;
+  type?: string;
+  payload?: Record<string, unknown>;
+}
+
+/** Split into complete, newline-terminated lines only (drop a trailing partial). */
+export function completeLines(text: string): string[] {
+  const lines = text.split("\n");
+  // If the text does not end in a newline, the last element is a partial line.
+  if (!text.endsWith("\n")) lines.pop();
+  return lines.filter((l) => l.trim() !== "");
+}
+
+export function parseLine(line: string): RolloutLine | null {
+  try { return JSON.parse(line) as RolloutLine; } catch { return null; }
+}
+
+export interface RolloutHeader {
+  id?: string;
+  cwd?: string;
+  timestamp?: string;
+  /**
+   * The thread that spawned this one. Present ONLY on a subagent's own rollout,
+   * which codex writes into the same sessions tree as a real conversation — so
+   * this is what separates "a session the user started" from "one step inside
+   * one".
+   */
+  parentThreadId?: string;
+  /** First user prompt, trimmed to a session-list label. */
+  title?: string;
+}
+
+/** How far into a rollout to look for the opening prompt before giving up. */
+const TITLE_SCAN_LINES = 2000;
+const TITLE_MAX_CHARS = 80;
+
+/** First user prompt → a one-line label. */
+function toTitle(text: string): string | undefined {
+  const flat = text.replace(/\s+/g, " ").trim();
+  if (!flat) return undefined;
+  return flat.length > TITLE_MAX_CHARS ? `${flat.slice(0, TITLE_MAX_CHARS - 1)}…` : flat;
+}
+
+/**
+ * Read the `session_meta` header, and (when `withTitle`) the first user prompt.
+ *
+ * A subagent rollout has no user prompt at all — its task arrives as encrypted
+ * scaffolding — so the title scan is skipped for one rather than walking the
+ * whole file to find nothing.
+ */
+export function readRolloutHeader(text: string, opts?: { withTitle?: boolean }): RolloutHeader | null {
+  let header: RolloutHeader | null = null;
+  let scanned = 0;
+
+  for (const line of completeLines(text)) {
+    const rec = parseLine(line);
+    if (!rec) continue;
+    const p = rec.payload ?? {};
+
+    if (rec.type === "session_meta" && !header) {
+      header = {
+        id: typeof p.id === "string" ? p.id : undefined,
+        cwd: typeof p.cwd === "string" ? p.cwd : undefined,
+        timestamp: typeof p.timestamp === "string" ? p.timestamp : rec.timestamp,
+        parentThreadId: typeof p.parent_thread_id === "string" ? p.parent_thread_id : undefined,
+      };
+      if (!opts?.withTitle || header.parentThreadId) return header;
+      continue;
+    }
+
+    if (!header || rec.type !== "event_msg") continue;
+    if (++scanned > TITLE_SCAN_LINES) break;
+
+    if (p.type === "user_message" && typeof p.message === "string") {
+      header.title = toTitle(p.message);
+      if (header.title) return header;
+    } else if (p.type === "item_completed") {
+      const mapped = mapRolloutItem(p.item);
+      if (mapped.kind === "user") {
+        header.title = toTitle(mapped.text);
+        if (header.title) return header;
+      }
+    }
+  }
+  return header;
+}

package/src/providers/codex-app-server/codex-rollout-items.ts

@@ -1,5 +1,6 @@
 import type { ChatEvent } from "../provider.interface.ts";
 import { redactTruncate } from "./codex-redact.ts";
+import { parseSubagentActivity, type SubagentActivity } from "./codex-subagent-thread.ts";
 
 /**
  * Rollout `item_completed` records → PPM chat events.
@@ -25,6 +26,9 @@ export type RolloutItemMapping =
   | { kind: "user"; text: string }
   | { kind: "assistant"; text: string }
   | { kind: "events"; events: ChatEvent[] }
+  // A spawned thread: the parser turns it into a card and hangs the child
+  // transcript under it, which needs the sessions dir it cannot reach itself.
+  | { kind: "subagent"; activity: SubagentActivity }
   | { kind: "ignore" };
 
 const IGNORED_ITEM_TYPES = new Set([
@@ -129,6 +133,8 @@ export function mapRolloutItem(item: unknown): RolloutItemMapping {
   const type = typeof it.type === "string" ? it.type : "";
 
   if (IGNORED_ITEM_TYPES.has(type)) return { kind: "ignore" };
+  const subagent = parseSubagentActivity(it);
+  if (subagent) return { kind: "subagent", activity: subagent };
   if (type === "UserMessage") {
     const text = textFrom(it.content);
     return text ? { kind: "user", text } : { kind: "ignore" };

package/src/providers/codex-app-server/codex-rollout-transfer.ts

@@ -0,0 +1,58 @@
+/**
+ * Moving a conversation's transcript into the CODEX_HOME that is about to serve it.
+ *
+ * Codex resolves a thread only against its OWN sessions directory. The `path` argument to
+ * `thread/resume` looks like an escape from that, and it is not: a path outside the running
+ * app-server's CODEX_HOME is refused with the same "no rollout found for thread id" as
+ * passing no path at all. Verified directly — the identical request succeeds when the
+ * app-server runs on the home the rollout lives in, and fails when it runs on another.
+ *
+ * So a session that changes account — because the user picked a different one, or because a
+ * usage limit forced the move — has its history sitting in a directory the new account's
+ * app-server will not look in, and resuming it is impossible until the file is there. It
+ * gets copied rather than moved: the account it came from may still be serving other
+ * sessions whose own history sits in the same tree, and the original is what PPM reads for
+ * any view of the conversation that is not this live thread.
+ *
+ * From here codex appends to the copy, so the newest history is in the account now serving
+ * the session — which is why `codexSessionsDirs` searches the bound account's directory
+ * first.
+ */
+
+import { copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+
+/** Case-insensitive on win32, so two spellings of one directory compare equal. */
+function samePath(a: string, b: string): boolean {
+  const norm = (p: string) => (process.platform === "win32" ? resolve(p).toLowerCase() : resolve(p));
+  return norm(a) === norm(b);
+}
+
+/**
+ * Ensure a rollout is inside `targetSessionsDir`, and return the path to use.
+ *
+ * A rollout already in the target directory is returned untouched — the common case, where
+ * the session is still on the account that wrote it, and nothing should be copied.
+ *
+ * The relative layout is preserved (`YYYY/MM/DD/rollout-….jsonl`) because that is where
+ * codex's own scan expects to find it.
+ *
+ * Failures are surfaced rather than swallowed: the caller's next act is a resume that
+ * cannot work without this, and a silent failure there turns into a conversation that
+ * quietly starts over as a new thread.
+ */
+export function localizeRollout(
+  rolloutPath: string,
+  foundInSessionsDir: string,
+  targetSessionsDir: string,
+): string {
+  if (samePath(foundInSessionsDir, targetSessionsDir)) return rolloutPath;
+  const dest = join(targetSessionsDir, relative(foundInSessionsDir, rolloutPath));
+  if (existsSync(dest)) return dest;
+  const destDir = dirname(dest);
+  // Only create what is missing. A recursive mkdir over an existing Windows directory
+  // carrying the read-only attribute throws EEXIST rather than succeeding quietly.
+  if (!existsSync(destDir)) mkdirSync(destDir, { recursive: true });
+  copyFileSync(rolloutPath, dest);
+  return dest;
+}

package/src/providers/codex-app-server/codex-subagent-thread.ts

@@ -0,0 +1,103 @@
+import type { ChatEvent, ChatMessage } from "../provider.interface.ts";
+import { redactTruncate } from "./codex-redact.ts";
+
+/**
+ * Subagent threads, rendered as one Agent card in the conversation that spawned
+ * them.
+ *
+ * Codex writes a spawned subagent as a rollout of its own, in the same sessions
+ * tree and with the same `cwd` as a real conversation. Left alone it surfaces
+ * twice over: once as a top-level session that opens mid-stream (it has no user
+ * prompt — the task is handed over as encrypted scaffolding), and once as two
+ * bare `SubAgentActivity` cards in the parent. Folding the child transcript into
+ * the parent's card is what makes it one step of one conversation again.
+ */
+
+/** Codex spells the item PascalCase in a rollout and camelCase on the wire. */
+export const SUBAGENT_ITEM_TYPES = new Set(["SubAgentActivity", "subAgentActivity"]);
+
+export interface SubagentActivity {
+  /** Rollout id of the spawned thread — the link to its transcript. */
+  threadId: string;
+  /** Codex's name for the agent, e.g. `/root/simplify_login`. */
+  path: string;
+  done: boolean;
+}
+
+/** The transcript of a spawned thread, ready to hang under its card. */
+export interface SubagentTranscript {
+  events: ChatEvent[];
+  /** The agent's closing message — its report back to the parent. */
+  finalText: string;
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === "string" && v ? v : undefined;
+}
+
+/** A `SubAgentActivity` item → normalized activity, or null if it is not one. */
+export function parseSubagentActivity(item: unknown): SubagentActivity | null {
+  if (!item || typeof item !== "object") return null;
+  const it = item as Record<string, unknown>;
+  if (!SUBAGENT_ITEM_TYPES.has(String(it.type ?? ""))) return null;
+  const threadId = str(it.agent_thread_id) ?? str(it.agentThreadId);
+  if (!threadId) return null;
+  const kind = String(it.kind ?? "");
+  return {
+    threadId,
+    path: str(it.agent_path) ?? str(it.agentPath) ?? "subagent",
+    done: kind === "completed" || kind === "failed",
+  };
+}
+
+/**
+ * Card id derived from the spawned thread.
+ *
+ * The started and completed records carry DIFFERENT item ids (`call_…` vs
+ * `subagent-completed-…`), so pairing on the item id leaves the call unanswered
+ * and the completion orphaned as a second card. The thread they both name is
+ * the stable key.
+ */
+export function subagentCardId(threadId: string): string {
+  return `subagent-${threadId}`;
+}
+
+/** The spawn, as the Agent card the chat already knows how to expand. */
+export function subagentToolUse(activity: SubagentActivity, transcript?: SubagentTranscript | null): ChatEvent {
+  return {
+    type: "tool_use",
+    tool: "Agent",
+    input: { description: activity.path },
+    toolUseId: subagentCardId(activity.threadId),
+    ...(transcript?.events.length ? { children: transcript.events } : {}),
+  };
+}
+
+/** The completion, answering the card above with the agent's own report. */
+export function subagentToolResult(activity: SubagentActivity, transcript?: SubagentTranscript | null): ChatEvent {
+  return {
+    type: "tool_result",
+    output: redactTruncate(transcript?.finalText || `${activity.path} finished`),
+    toolUseId: subagentCardId(activity.threadId),
+  };
+}
+
+/** A parsed child transcript → the flat event list a card nests. */
+export function transcriptToEvents(messages: ChatMessage[]): ChatEvent[] {
+  const events: ChatEvent[] = [];
+  for (const m of messages) {
+    // An assistant turn with tool calls already carries its text as the last event.
+    if (m.events?.length) events.push(...m.events);
+    else if (m.content) events.push({ type: "text", content: m.content });
+  }
+  return events;
+}
+
+/** The agent's closing message, which is what it reported back. */
+export function finalAssistantText(messages: ChatMessage[]): string {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]!;
+    if (m.role === "assistant" && m.content) return m.content;
+  }
+  return "";
+}

package/src/providers/codex-app-server/codex-usage-limit.ts

@@ -0,0 +1,69 @@
+/**
+ * Recognising a Codex usage-limit refusal.
+ *
+ * Codex reports an exhausted quota as an ordinary `error` notification — the same shape it
+ * uses for a malformed request or a dead sandbox — so the wording is the only thing that
+ * separates "this account is out of credit until 4:21 PM" from a failure that switching
+ * accounts cannot fix. Matching text is therefore load-bearing here rather than cosmetic:
+ * it decides whether the turn moves to another account or stops in front of the user.
+ *
+ * The patterns are deliberately narrow. A false positive parks a working account for
+ * hours, so a match needs the phrase Codex actually uses and not the bare word "limit",
+ * which also shows up in context-window and file-size errors.
+ */
+
+const USAGE_LIMIT_PATTERNS = [
+  /hit\s+your\s+(?:usage|rate)\s+limit/i,
+  /reached\s+your\s+usage\s+limit/i,
+  /usage\s+limit\s+reached/i,
+];
+
+/** Whether this error text means the account's quota is spent. */
+export function isCodexUsageLimit(message: string): boolean {
+  return USAGE_LIMIT_PATTERNS.some((re) => re.test(message));
+}
+
+/** The message carried by a codex `error` notification, whatever shape it arrived in. */
+export function codexErrorMessage(params: unknown): string {
+  const p = (params && typeof params === "object" ? params : {}) as Record<string, unknown>;
+  const err = (p.error && typeof p.error === "object" ? p.error : {}) as Record<string, unknown>;
+  if (typeof err.message === "string") return err.message;
+  if (typeof p.message === "string") return p.message;
+  return "";
+}
+
+/** Turn an hour/minute into the next epoch-ms at which the clock next reads that time. */
+function nextOccurrence(hour: number, minute: number, ampm?: string): number | undefined {
+  if (!Number.isFinite(hour) || hour > 23 || minute > 59) return undefined;
+  let h = hour;
+  if (ampm === "pm" && h < 12) h += 12;
+  if (ampm === "am" && h === 12) h = 0;
+  const now = new Date();
+  const reset = new Date(now);
+  reset.setHours(h, minute, 0, 0);
+  // Already past today, so the refusal must be pointing at tomorrow.
+  if (reset.getTime() <= now.getTime()) reset.setDate(reset.getDate() + 1);
+  return reset.getTime();
+}
+
+/**
+ * When the refused account is worth trying again, read out of the refusal itself.
+ *
+ * Codex phrases it two ways — an absolute "try again at 4:21 PM" and a relative "try again
+ * in 3 hours" — and both are parsed because the caller uses the answer to decide how long
+ * to park the account. Returns null when the message says nothing about a reset, which the
+ * caller treats as "park for the default window" rather than "do not park".
+ */
+export function parseCodexUsageLimitReset(message: string): { text?: string; atMs?: number } | null {
+  const relative = /try\s+again\s+in\s+(\d+)\s*(second|minute|hour|day)s?/i.exec(message);
+  if (relative) {
+    const n = Number(relative[1]);
+    const unitMs = { second: 1000, minute: 60_000, hour: 3_600_000, day: 86_400_000 }[relative[2]!.toLowerCase()]!;
+    return { text: `in ${n} ${relative[2]!.toLowerCase()}${n === 1 ? "" : "s"}`, atMs: Date.now() + n * unitMs };
+  }
+  const absolute = /(?:try\s+again|resets?)\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i.exec(message);
+  if (!absolute) return null;
+  const text = absolute[0].replace(/^(?:try\s+again|resets?)\s+(?:at\s+)?/i, "").trim();
+  const atMs = nextOccurrence(Number(absolute[1]), absolute[2] ? Number(absolute[2]) : 0, absolute[3]?.toLowerCase());
+  return { text: text || undefined, ...(atMs != null ? { atMs } : {}) };
+}

package/src/providers/codex-app-server/codex-usage-parser.ts

@@ -27,26 +27,43 @@ function toBucket(w: RateLimitWindow | null | undefined): LimitBucket | undefine
   };
 }
 
+/** A window at least this long is a plan's long bucket rather than its short one. */
+const LONG_WINDOW_MINS = 24 * 60;
+
 /**
- * Map codex `account/rateLimits/read` → PPM UsageInfo. `primary` window ≈ short
- * (5h-like) bucket, `secondary` ≈ long (weekly-like) bucket. Empty/missing → {}.
+ * Map codex `account/rateLimits/read` → PPM UsageInfo.
+ *
+ * `primary` and `secondary` are positions, not meanings, and each window states its own
+ * length in `windowDurationMins` — so that is what decides which bucket it belongs to. A
+ * Plus plan sends a 300-minute window followed by a 10080-minute one, which is the layout
+ * the old positional reading assumed. A ChatGPT Business plan sends the 10080-minute weekly
+ * window **alone, in the primary slot**, and reading position as meaning labelled that
+ * account's weekly quota "5-Hour" — complete with a reset nearly seven days out — while
+ * leaving its actual Weekly row empty.
+ *
+ * Empty/missing → `{}`, which the UI reads as "the quota could not be read" and is a
+ * different thing from a plan that genuinely has only one window.
  */
 export function parseCodexUsage(res: GetAccountRateLimitsResponse | null | undefined): UsageInfo {
   const snap = res?.rateLimits;
   if (!snap) return {};
-  const primary = snap.primary ?? null;
-  const secondary = snap.secondary ?? null;
   const out: UsageInfo = {};
-  if (primary?.usedPercent != null) {
-    out.fiveHour = primary.usedPercent / 100;
-    out.fiveHourResetsAt = toIso(primary.resetsAt);
-    out.session = toBucket(primary);
-  }
-  if (secondary?.usedPercent != null) {
-    out.sevenDay = secondary.usedPercent / 100;
-    out.sevenDayResetsAt = toIso(secondary.resetsAt);
-    out.weekly = toBucket(secondary);
-  }
+  const windows = [snap.primary ?? null, snap.secondary ?? null];
+  windows.forEach((w, slot) => {
+    if (w?.usedPercent == null) return;
+    // A window with no declared duration leaves nothing to read, so the slot it arrived in
+    // is the best guess remaining: primary is the short one wherever both are present.
+    const isLong = w.windowDurationMins != null ? w.windowDurationMins >= LONG_WINDOW_MINS : slot === 1;
+    if (isLong) {
+      out.sevenDay = w.usedPercent / 100;
+      out.sevenDayResetsAt = toIso(w.resetsAt);
+      out.weekly = toBucket(w);
+    } else {
+      out.fiveHour = w.usedPercent / 100;
+      out.fiveHourResetsAt = toIso(w.resetsAt);
+      out.session = toBucket(w);
+    }
+  });
   if (snap.planType) out.activeAccountLabel = String(snap.planType);
   return out;
 }

package/src/server/routes/chat.ts

@@ -498,6 +498,23 @@ chatRoutes.put("/sessions/:id/account", async (c) => {
   if (!bindPickedAccount(sessionId, providerId, body.accountId)) {
     return c.json(err(bindRefusalReason(providerId, body.accountId)), 400);
   }
+  // Codex binds an account by spawning its app-server with that account's CODEX_HOME, so a
+  // subprocess already running keeps serving the old account however the binding reads — the
+  // switch appeared to do nothing until something else happened to kill it. Dropping it while
+  // idle makes the next message respawn on the account the user just picked. Claude needs
+  // none of this: it reads the binding per turn, and there is nothing stale to clear.
+  if (providerId === "codex") {
+    const { listRunningSessions, dropIdleSubprocess } = await import("../ws/chat.ts");
+    // Never mid-turn. The answer being streamed would be lost, and the switch takes effect
+    // on the next message either way — which is exactly what the picker promises.
+    if (!listRunningSessions().some((s) => s.sessionId === sessionId)) {
+      dropIdleSubprocess(
+        sessionId,
+        "account_switch",
+        "Subprocess released: the session was moved to another Codex account",
+      );
+    }
+  }
   return c.json(ok({ accountId: body.accountId }));
 });
 
@@ -893,7 +910,7 @@ chatRoutes.post("/sessions/:id/images/strip", async (c) => {
     const mode: StripMode = (body as { mode?: unknown }).mode === "all" ? "all" : "oversized";
     const includeAttachments = (body as { includeAttachments?: unknown }).includeAttachments === true;
 
-    const { listRunningSessions, dropSubprocessForTranscriptRewrite } = await import("../ws/chat.ts");
+    const { listRunningSessions, dropIdleSubprocess } = await import("../ws/chat.ts");
     if (listRunningSessions().some((s) => s.sessionId === sessionId)) {
       return c.json(err("Session is running — wait for the turn to finish"), 409);
     }
@@ -906,7 +923,11 @@ chatRoutes.post("/sessions/:id/images/strip", async (c) => {
     // re-sends the oversized attachment from memory and fails exactly as before, which is the
     // failure this endpoint exists to clear. Drop it so the turn is rebuilt from the file we
     // are about to rewrite.
-    dropSubprocessForTranscriptRewrite(sessionId);
+    dropIdleSubprocess(
+      sessionId,
+      "transcript_rewritten",
+      "Subprocess released: the transcript was rewritten, so the next turn is rebuilt from disk",
+    );
 
     const result = await stripTranscriptImagesFile(found.path, mode, { includeAttachments });
     return c.json(ok({

package/src/server/routes/codex-accounts.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { ok, err } from "../../types/api.ts";
-import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, type CodexStrategy } from "../../services/codex-account.service.ts";
-import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin } from "../../services/codex-account-login.ts";
+import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, codexUsageLevel, type CodexStrategy } from "../../services/codex-account.service.ts";
+import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin, startBrowserLogin, submitBrowserCallback, getBrowserLoginStatus, cancelBrowserLogin } from "../../services/codex-account-login.ts";
 import { exportCodexEncrypted, importCodexEncrypted } from "../../services/codex-account-portability.ts";
 
 /** Codex multi-account management. Mounted under /api/codex-accounts (auth-guarded). */
@@ -29,7 +29,7 @@ codexAccountsRoutes.post("/pick", async (c) => {
   const usages = await getAllCodexUsages();
   // A failed usage fetch yields {} → +Infinity, which the selector reads as "unknown", not
   // as "capped": an account we could not measure stays a candidate.
-  const picked = selectCodexAccount({ usageOf: (id) => usages[id]?.fiveHour ?? Number.POSITIVE_INFINITY });
+  const picked = selectCodexAccount({ usageOf: (id) => codexUsageLevel(usages[id]) });
   if (!picked) return c.json(ok(null));
   return c.json(ok({ id: picked.id, label: picked.label }));
 });
@@ -86,6 +86,35 @@ codexAccountsRoutes.delete("/device-login/:id", (c) => {
   return c.json(ok({ cancelled: true }));
 });
 
+/** Browser OAuth uses the same durable polling as device-code login. */
+codexAccountsRoutes.post("/browser-login", async (c) => {
+  const body = await c.req.json<{ label?: string }>().catch(() => ({} as { label?: string }));
+  if (body.label !== undefined && typeof body.label !== "string") return c.json(err("label must be a string"), 400);
+  c.header("Cache-Control", "no-store");
+  try { return c.json(ok(await startBrowserLogin(body.label))); }
+  catch (e) { return c.json(err((e as Error).message), 400); }
+});
+
+codexAccountsRoutes.post("/browser-login/:id/callback", async (c) => {
+  const body = await c.req.json<{ callbackUrl?: string }>().catch(() => ({} as { callbackUrl?: string }));
+  c.header("Cache-Control", "no-store");
+  if (typeof body.callbackUrl !== "string") return c.json(err("callbackUrl is required"), 400);
+  try {
+    submitBrowserCallback(c.req.param("id"), body.callbackUrl);
+    return c.json(ok({ submitted: true }));
+  } catch (e) { return c.json(err((e as Error).message), 400); }
+});
+
+codexAccountsRoutes.get("/browser-login/:id/status", (c) => {
+  c.header("Cache-Control", "no-store");
+  return c.json(ok(getBrowserLoginStatus(c.req.param("id"))));
+});
+
+codexAccountsRoutes.delete("/browser-login/:id", (c) => {
+  cancelBrowserLogin(c.req.param("id"));
+  return c.json(ok({ cancelled: true }));
+});
+
 /** Download a password-encrypted backup of codex accounts (auth.json + apiKey creds). */
 codexAccountsRoutes.post("/export", async (c) => {
   const body = await c.req.json<{ password?: string; accountIds?: string[] }>().catch(() => ({} as { password?: string; accountIds?: string[] }));

package/src/server/ws/chat.ts

@@ -164,27 +164,31 @@ function releaseSubprocess(sessionId: string, reason: string, note: string): voi
 }
 
 /**
- * Drop a session's live subprocess so its next turn is rebuilt from the transcript on disk.
+ * Drop a session's live subprocess so its next turn is rebuilt from what is on disk.
  *
- * Routes that rewrite the JSONL need this. The subprocess holds the conversation in memory,
- * so a rewrite it never learns about simply does not apply: the user strips an oversized
- * image, sends again, and the same image is re-sent from memory and fails identically.
- * `listRunningSessions()` does not cover it — that skips `phase === "idle"`, and a warm idle
- * subprocess is exactly this case. Unlike `releaseSubprocess` it does not require the session
- * to be clientless, because the tab being open is the normal way to reach the strip button.
+ * Two kinds of caller need this, both because the subprocess holds state that a change
+ * made behind its back cannot reach. A route that rewrites the JSONL: the user strips an
+ * oversized image, sends again, and the same image is re-sent from memory and fails
+ * identically. And a codex account switch: the app-server was spawned with one account's
+ * CODEX_HOME and keeps serving that account no matter what the session's binding now says.
+ *
+ * `listRunningSessions()` does not cover either case — that skips `phase === "idle"`, and a
+ * warm idle subprocess is exactly what both are about. Unlike `releaseSubprocess` this does
+ * not require the session to be clientless, because having the tab open is the normal way
+ * to reach both buttons.
  */
-export function dropSubprocessForTranscriptRewrite(sessionId: string): void {
+export function dropIdleSubprocess(sessionId: string, reason: string, note: string): void {
   const entry = activeSessions.get(sessionId);
   if (!entry) return;
   const provider = providerRegistry.get(entry.providerId);
   if (!provider?.hasStreamingSession?.(sessionId)) return;
-  provider.abortQuery?.(sessionId, "transcript_rewritten");
+  provider.abortQuery?.(sessionId, reason);
   if (entry.cacheReleaseTimer) {
     clearTimeout(entry.cacheReleaseTimer);
     entry.cacheReleaseTimer = undefined;
   }
-  console.log(`[chat] session=${sessionId} released subprocess (transcript_rewritten)`);
-  logSessionEvent(sessionId, "INFO", "Subprocess released: the transcript was rewritten, so the next turn is rebuilt from disk");
+  console.log(`[chat] session=${sessionId} released subprocess (${reason})`);
+  logSessionEvent(sessionId, "INFO", note);
 }
 
 /** Tear down the longest-idle subprocesses once too many sessions are holding one. */

package/src/services/codex-account-cooldown.ts

@@ -0,0 +1,56 @@
+/**
+ * Codex accounts parked after the app-server refused a turn for an exhausted quota.
+ *
+ * Kept apart from the account rows on purpose. `CodexAccountStatus` is the user's switch —
+ * on or off — and writing a quota refusal into it would show an account the user never
+ * disabled as switched off in Settings, with no way to tell the two apart when it came
+ * back. Parking is the server's own short-lived opinion about an account, so it lives in
+ * memory and lapses on its own.
+ *
+ * In-memory is also the honest lifetime: the park exists to stop a rotation from handing
+ * the next turn straight back to the account that just refused it, and a server restart
+ * re-learns that on the first refusal anyway.
+ */
+
+/** accountId → epoch ms at which the account is worth trying again. */
+const parkedUntil = new Map<string, number>();
+
+/**
+ * How long an account sits out when the refusal carried no reset time.
+ *
+ * Codex's short bucket is five hours, so that is the cheapest correct guess. Guessing long
+ * is safe in a way guessing short is not: an account that recovers early is only skipped
+ * while another one can serve, whereas a park that lapses too early sends the turn back to
+ * an account that refuses it again.
+ */
+const DEFAULT_PARK_MS = 5 * 60 * 60 * 1000;
+
+/** Park an account until its quota resets. `resetAtMs` in the past falls back to the default. */
+export function markCodexAccountUsageLimited(accountId: string, resetAtMs?: number): void {
+  const now = Date.now();
+  const until = resetAtMs != null && resetAtMs > now ? resetAtMs : now + DEFAULT_PARK_MS;
+  parkedUntil.set(accountId, until);
+}
+
+/** Whether the account is still sitting out. Lapsed entries are dropped as they are read. */
+export function isCodexAccountUsageLimited(accountId: string): boolean {
+  const until = parkedUntil.get(accountId);
+  if (until == null) return false;
+  if (until <= Date.now()) { parkedUntil.delete(accountId); return false; }
+  return true;
+}
+
+/** When the account is next worth trying, or null if it is not parked. */
+export function codexUsageLimitResetAt(accountId: string): number | null {
+  return isCodexAccountUsageLimited(accountId) ? parkedUntil.get(accountId)! : null;
+}
+
+/** Let an account back in early — a successful turn proves the park is stale. */
+export function clearCodexAccountUsageLimit(accountId: string): void {
+  parkedUntil.delete(accountId);
+}
+
+/** Test seam: forget every park. */
+export function _resetCodexCooldownsForTesting(): void {
+  parkedUntil.clear();
+}