@hienlh/ppm 0.20.1 → 0.20.3

package/src/providers/codex-app-server/codex-subagent-thread.ts

@@ -0,0 +1,103 @@
+import type { ChatEvent, ChatMessage } from "../provider.interface.ts";
+import { redactTruncate } from "./codex-redact.ts";
+
+/**
+ * Subagent threads, rendered as one Agent card in the conversation that spawned
+ * them.
+ *
+ * Codex writes a spawned subagent as a rollout of its own, in the same sessions
+ * tree and with the same `cwd` as a real conversation. Left alone it surfaces
+ * twice over: once as a top-level session that opens mid-stream (it has no user
+ * prompt — the task is handed over as encrypted scaffolding), and once as two
+ * bare `SubAgentActivity` cards in the parent. Folding the child transcript into
+ * the parent's card is what makes it one step of one conversation again.
+ */
+
+/** Codex spells the item PascalCase in a rollout and camelCase on the wire. */
+export const SUBAGENT_ITEM_TYPES = new Set(["SubAgentActivity", "subAgentActivity"]);
+
+export interface SubagentActivity {
+  /** Rollout id of the spawned thread — the link to its transcript. */
+  threadId: string;
+  /** Codex's name for the agent, e.g. `/root/simplify_login`. */
+  path: string;
+  done: boolean;
+}
+
+/** The transcript of a spawned thread, ready to hang under its card. */
+export interface SubagentTranscript {
+  events: ChatEvent[];
+  /** The agent's closing message — its report back to the parent. */
+  finalText: string;
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === "string" && v ? v : undefined;
+}
+
+/** A `SubAgentActivity` item → normalized activity, or null if it is not one. */
+export function parseSubagentActivity(item: unknown): SubagentActivity | null {
+  if (!item || typeof item !== "object") return null;
+  const it = item as Record<string, unknown>;
+  if (!SUBAGENT_ITEM_TYPES.has(String(it.type ?? ""))) return null;
+  const threadId = str(it.agent_thread_id) ?? str(it.agentThreadId);
+  if (!threadId) return null;
+  const kind = String(it.kind ?? "");
+  return {
+    threadId,
+    path: str(it.agent_path) ?? str(it.agentPath) ?? "subagent",
+    done: kind === "completed" || kind === "failed",
+  };
+}
+
+/**
+ * Card id derived from the spawned thread.
+ *
+ * The started and completed records carry DIFFERENT item ids (`call_…` vs
+ * `subagent-completed-…`), so pairing on the item id leaves the call unanswered
+ * and the completion orphaned as a second card. The thread they both name is
+ * the stable key.
+ */
+export function subagentCardId(threadId: string): string {
+  return `subagent-${threadId}`;
+}
+
+/** The spawn, as the Agent card the chat already knows how to expand. */
+export function subagentToolUse(activity: SubagentActivity, transcript?: SubagentTranscript | null): ChatEvent {
+  return {
+    type: "tool_use",
+    tool: "Agent",
+    input: { description: activity.path },
+    toolUseId: subagentCardId(activity.threadId),
+    ...(transcript?.events.length ? { children: transcript.events } : {}),
+  };
+}
+
+/** The completion, answering the card above with the agent's own report. */
+export function subagentToolResult(activity: SubagentActivity, transcript?: SubagentTranscript | null): ChatEvent {
+  return {
+    type: "tool_result",
+    output: redactTruncate(transcript?.finalText || `${activity.path} finished`),
+    toolUseId: subagentCardId(activity.threadId),
+  };
+}
+
+/** A parsed child transcript → the flat event list a card nests. */
+export function transcriptToEvents(messages: ChatMessage[]): ChatEvent[] {
+  const events: ChatEvent[] = [];
+  for (const m of messages) {
+    // An assistant turn with tool calls already carries its text as the last event.
+    if (m.events?.length) events.push(...m.events);
+    else if (m.content) events.push({ type: "text", content: m.content });
+  }
+  return events;
+}
+
+/** The agent's closing message, which is what it reported back. */
+export function finalAssistantText(messages: ChatMessage[]): string {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]!;
+    if (m.role === "assistant" && m.content) return m.content;
+  }
+  return "";
+}

package/src/providers/codex-app-server/codex-usage-limit.ts

@@ -0,0 +1,69 @@
+/**
+ * Recognising a Codex usage-limit refusal.
+ *
+ * Codex reports an exhausted quota as an ordinary `error` notification — the same shape it
+ * uses for a malformed request or a dead sandbox — so the wording is the only thing that
+ * separates "this account is out of credit until 4:21 PM" from a failure that switching
+ * accounts cannot fix. Matching text is therefore load-bearing here rather than cosmetic:
+ * it decides whether the turn moves to another account or stops in front of the user.
+ *
+ * The patterns are deliberately narrow. A false positive parks a working account for
+ * hours, so a match needs the phrase Codex actually uses and not the bare word "limit",
+ * which also shows up in context-window and file-size errors.
+ */
+
+const USAGE_LIMIT_PATTERNS = [
+  /hit\s+your\s+(?:usage|rate)\s+limit/i,
+  /reached\s+your\s+usage\s+limit/i,
+  /usage\s+limit\s+reached/i,
+];
+
+/** Whether this error text means the account's quota is spent. */
+export function isCodexUsageLimit(message: string): boolean {
+  return USAGE_LIMIT_PATTERNS.some((re) => re.test(message));
+}
+
+/** The message carried by a codex `error` notification, whatever shape it arrived in. */
+export function codexErrorMessage(params: unknown): string {
+  const p = (params && typeof params === "object" ? params : {}) as Record<string, unknown>;
+  const err = (p.error && typeof p.error === "object" ? p.error : {}) as Record<string, unknown>;
+  if (typeof err.message === "string") return err.message;
+  if (typeof p.message === "string") return p.message;
+  return "";
+}
+
+/** Turn an hour/minute into the next epoch-ms at which the clock next reads that time. */
+function nextOccurrence(hour: number, minute: number, ampm?: string): number | undefined {
+  if (!Number.isFinite(hour) || hour > 23 || minute > 59) return undefined;
+  let h = hour;
+  if (ampm === "pm" && h < 12) h += 12;
+  if (ampm === "am" && h === 12) h = 0;
+  const now = new Date();
+  const reset = new Date(now);
+  reset.setHours(h, minute, 0, 0);
+  // Already past today, so the refusal must be pointing at tomorrow.
+  if (reset.getTime() <= now.getTime()) reset.setDate(reset.getDate() + 1);
+  return reset.getTime();
+}
+
+/**
+ * When the refused account is worth trying again, read out of the refusal itself.
+ *
+ * Codex phrases it two ways — an absolute "try again at 4:21 PM" and a relative "try again
+ * in 3 hours" — and both are parsed because the caller uses the answer to decide how long
+ * to park the account. Returns null when the message says nothing about a reset, which the
+ * caller treats as "park for the default window" rather than "do not park".
+ */
+export function parseCodexUsageLimitReset(message: string): { text?: string; atMs?: number } | null {
+  const relative = /try\s+again\s+in\s+(\d+)\s*(second|minute|hour|day)s?/i.exec(message);
+  if (relative) {
+    const n = Number(relative[1]);
+    const unitMs = { second: 1000, minute: 60_000, hour: 3_600_000, day: 86_400_000 }[relative[2]!.toLowerCase()]!;
+    return { text: `in ${n} ${relative[2]!.toLowerCase()}${n === 1 ? "" : "s"}`, atMs: Date.now() + n * unitMs };
+  }
+  const absolute = /(?:try\s+again|resets?)\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i.exec(message);
+  if (!absolute) return null;
+  const text = absolute[0].replace(/^(?:try\s+again|resets?)\s+(?:at\s+)?/i, "").trim();
+  const atMs = nextOccurrence(Number(absolute[1]), absolute[2] ? Number(absolute[2]) : 0, absolute[3]?.toLowerCase());
+  return { text: text || undefined, ...(atMs != null ? { atMs } : {}) };
+}

package/src/providers/codex-app-server/codex-usage-parser.ts

@@ -27,26 +27,43 @@ function toBucket(w: RateLimitWindow | null | undefined): LimitBucket | undefine
   };
 }
 
+/** A window at least this long is a plan's long bucket rather than its short one. */
+const LONG_WINDOW_MINS = 24 * 60;
+
 /**
- * Map codex `account/rateLimits/read` → PPM UsageInfo. `primary` window ≈ short
- * (5h-like) bucket, `secondary` ≈ long (weekly-like) bucket. Empty/missing → {}.
+ * Map codex `account/rateLimits/read` → PPM UsageInfo.
+ *
+ * `primary` and `secondary` are positions, not meanings, and each window states its own
+ * length in `windowDurationMins` — so that is what decides which bucket it belongs to. A
+ * Plus plan sends a 300-minute window followed by a 10080-minute one, which is the layout
+ * the old positional reading assumed. A ChatGPT Business plan sends the 10080-minute weekly
+ * window **alone, in the primary slot**, and reading position as meaning labelled that
+ * account's weekly quota "5-Hour" — complete with a reset nearly seven days out — while
+ * leaving its actual Weekly row empty.
+ *
+ * Empty/missing → `{}`, which the UI reads as "the quota could not be read" and is a
+ * different thing from a plan that genuinely has only one window.
  */
 export function parseCodexUsage(res: GetAccountRateLimitsResponse | null | undefined): UsageInfo {
   const snap = res?.rateLimits;
   if (!snap) return {};
-  const primary = snap.primary ?? null;
-  const secondary = snap.secondary ?? null;
   const out: UsageInfo = {};
-  if (primary?.usedPercent != null) {
-    out.fiveHour = primary.usedPercent / 100;
-    out.fiveHourResetsAt = toIso(primary.resetsAt);
-    out.session = toBucket(primary);
-  }
-  if (secondary?.usedPercent != null) {
-    out.sevenDay = secondary.usedPercent / 100;
-    out.sevenDayResetsAt = toIso(secondary.resetsAt);
-    out.weekly = toBucket(secondary);
-  }
+  const windows = [snap.primary ?? null, snap.secondary ?? null];
+  windows.forEach((w, slot) => {
+    if (w?.usedPercent == null) return;
+    // A window with no declared duration leaves nothing to read, so the slot it arrived in
+    // is the best guess remaining: primary is the short one wherever both are present.
+    const isLong = w.windowDurationMins != null ? w.windowDurationMins >= LONG_WINDOW_MINS : slot === 1;
+    if (isLong) {
+      out.sevenDay = w.usedPercent / 100;
+      out.sevenDayResetsAt = toIso(w.resetsAt);
+      out.weekly = toBucket(w);
+    } else {
+      out.fiveHour = w.usedPercent / 100;
+      out.fiveHourResetsAt = toIso(w.resetsAt);
+      out.session = toBucket(w);
+    }
+  });
   if (snap.planType) out.activeAccountLabel = String(snap.planType);
   return out;
 }

package/src/server/routes/chat.ts

@@ -498,6 +498,23 @@ chatRoutes.put("/sessions/:id/account", async (c) => {
   if (!bindPickedAccount(sessionId, providerId, body.accountId)) {
     return c.json(err(bindRefusalReason(providerId, body.accountId)), 400);
   }
+  // Codex binds an account by spawning its app-server with that account's CODEX_HOME, so a
+  // subprocess already running keeps serving the old account however the binding reads — the
+  // switch appeared to do nothing until something else happened to kill it. Dropping it while
+  // idle makes the next message respawn on the account the user just picked. Claude needs
+  // none of this: it reads the binding per turn, and there is nothing stale to clear.
+  if (providerId === "codex") {
+    const { listRunningSessions, dropIdleSubprocess } = await import("../ws/chat.ts");
+    // Never mid-turn. The answer being streamed would be lost, and the switch takes effect
+    // on the next message either way — which is exactly what the picker promises.
+    if (!listRunningSessions().some((s) => s.sessionId === sessionId)) {
+      dropIdleSubprocess(
+        sessionId,
+        "account_switch",
+        "Subprocess released: the session was moved to another Codex account",
+      );
+    }
+  }
   return c.json(ok({ accountId: body.accountId }));
 });
 
@@ -893,7 +910,7 @@ chatRoutes.post("/sessions/:id/images/strip", async (c) => {
     const mode: StripMode = (body as { mode?: unknown }).mode === "all" ? "all" : "oversized";
     const includeAttachments = (body as { includeAttachments?: unknown }).includeAttachments === true;
 
-    const { listRunningSessions, dropSubprocessForTranscriptRewrite } = await import("../ws/chat.ts");
+    const { listRunningSessions, dropIdleSubprocess } = await import("../ws/chat.ts");
     if (listRunningSessions().some((s) => s.sessionId === sessionId)) {
       return c.json(err("Session is running — wait for the turn to finish"), 409);
     }
@@ -906,7 +923,11 @@ chatRoutes.post("/sessions/:id/images/strip", async (c) => {
     // re-sends the oversized attachment from memory and fails exactly as before, which is the
     // failure this endpoint exists to clear. Drop it so the turn is rebuilt from the file we
     // are about to rewrite.
-    dropSubprocessForTranscriptRewrite(sessionId);
+    dropIdleSubprocess(
+      sessionId,
+      "transcript_rewritten",
+      "Subprocess released: the transcript was rewritten, so the next turn is rebuilt from disk",
+    );
 
     const result = await stripTranscriptImagesFile(found.path, mode, { includeAttachments });
     return c.json(ok({

package/src/server/routes/codex-accounts.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { ok, err } from "../../types/api.ts";
-import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, type CodexStrategy } from "../../services/codex-account.service.ts";
-import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin } from "../../services/codex-account-login.ts";
+import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, codexUsageLevel, type CodexStrategy } from "../../services/codex-account.service.ts";
+import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin, startBrowserLogin, submitBrowserCallback, getBrowserLoginStatus, cancelBrowserLogin } from "../../services/codex-account-login.ts";
 import { exportCodexEncrypted, importCodexEncrypted } from "../../services/codex-account-portability.ts";
 
 /** Codex multi-account management. Mounted under /api/codex-accounts (auth-guarded). */
@@ -29,7 +29,7 @@ codexAccountsRoutes.post("/pick", async (c) => {
   const usages = await getAllCodexUsages();
   // A failed usage fetch yields {} → +Infinity, which the selector reads as "unknown", not
   // as "capped": an account we could not measure stays a candidate.
-  const picked = selectCodexAccount({ usageOf: (id) => usages[id]?.fiveHour ?? Number.POSITIVE_INFINITY });
+  const picked = selectCodexAccount({ usageOf: (id) => codexUsageLevel(usages[id]) });
   if (!picked) return c.json(ok(null));
   return c.json(ok({ id: picked.id, label: picked.label }));
 });
@@ -86,6 +86,35 @@ codexAccountsRoutes.delete("/device-login/:id", (c) => {
   return c.json(ok({ cancelled: true }));
 });
 
+/** Browser OAuth uses the same durable polling as device-code login. */
+codexAccountsRoutes.post("/browser-login", async (c) => {
+  const body = await c.req.json<{ label?: string }>().catch(() => ({} as { label?: string }));
+  if (body.label !== undefined && typeof body.label !== "string") return c.json(err("label must be a string"), 400);
+  c.header("Cache-Control", "no-store");
+  try { return c.json(ok(await startBrowserLogin(body.label))); }
+  catch (e) { return c.json(err((e as Error).message), 400); }
+});
+
+codexAccountsRoutes.post("/browser-login/:id/callback", async (c) => {
+  const body = await c.req.json<{ callbackUrl?: string }>().catch(() => ({} as { callbackUrl?: string }));
+  c.header("Cache-Control", "no-store");
+  if (typeof body.callbackUrl !== "string") return c.json(err("callbackUrl is required"), 400);
+  try {
+    submitBrowserCallback(c.req.param("id"), body.callbackUrl);
+    return c.json(ok({ submitted: true }));
+  } catch (e) { return c.json(err((e as Error).message), 400); }
+});
+
+codexAccountsRoutes.get("/browser-login/:id/status", (c) => {
+  c.header("Cache-Control", "no-store");
+  return c.json(ok(getBrowserLoginStatus(c.req.param("id"))));
+});
+
+codexAccountsRoutes.delete("/browser-login/:id", (c) => {
+  cancelBrowserLogin(c.req.param("id"));
+  return c.json(ok({ cancelled: true }));
+});
+
 /** Download a password-encrypted backup of codex accounts (auth.json + apiKey creds). */
 codexAccountsRoutes.post("/export", async (c) => {
   const body = await c.req.json<{ password?: string; accountIds?: string[] }>().catch(() => ({} as { password?: string; accountIds?: string[] }));

package/src/server/ws/chat.ts

@@ -164,27 +164,31 @@ function releaseSubprocess(sessionId: string, reason: string, note: string): voi
 }
 
 /**
- * Drop a session's live subprocess so its next turn is rebuilt from the transcript on disk.
+ * Drop a session's live subprocess so its next turn is rebuilt from what is on disk.
  *
- * Routes that rewrite the JSONL need this. The subprocess holds the conversation in memory,
- * so a rewrite it never learns about simply does not apply: the user strips an oversized
- * image, sends again, and the same image is re-sent from memory and fails identically.
- * `listRunningSessions()` does not cover it — that skips `phase === "idle"`, and a warm idle
- * subprocess is exactly this case. Unlike `releaseSubprocess` it does not require the session
- * to be clientless, because the tab being open is the normal way to reach the strip button.
+ * Two kinds of caller need this, both because the subprocess holds state that a change
+ * made behind its back cannot reach. A route that rewrites the JSONL: the user strips an
+ * oversized image, sends again, and the same image is re-sent from memory and fails
+ * identically. And a codex account switch: the app-server was spawned with one account's
+ * CODEX_HOME and keeps serving that account no matter what the session's binding now says.
+ *
+ * `listRunningSessions()` does not cover either case — that skips `phase === "idle"`, and a
+ * warm idle subprocess is exactly what both are about. Unlike `releaseSubprocess` this does
+ * not require the session to be clientless, because having the tab open is the normal way
+ * to reach both buttons.
  */
-export function dropSubprocessForTranscriptRewrite(sessionId: string): void {
+export function dropIdleSubprocess(sessionId: string, reason: string, note: string): void {
   const entry = activeSessions.get(sessionId);
   if (!entry) return;
   const provider = providerRegistry.get(entry.providerId);
   if (!provider?.hasStreamingSession?.(sessionId)) return;
-  provider.abortQuery?.(sessionId, "transcript_rewritten");
+  provider.abortQuery?.(sessionId, reason);
   if (entry.cacheReleaseTimer) {
     clearTimeout(entry.cacheReleaseTimer);
     entry.cacheReleaseTimer = undefined;
   }
-  console.log(`[chat] session=${sessionId} released subprocess (transcript_rewritten)`);
-  logSessionEvent(sessionId, "INFO", "Subprocess released: the transcript was rewritten, so the next turn is rebuilt from disk");
+  console.log(`[chat] session=${sessionId} released subprocess (${reason})`);
+  logSessionEvent(sessionId, "INFO", note);
 }
 
 /** Tear down the longest-idle subprocesses once too many sessions are holding one. */

package/src/services/codex-account-cooldown.ts

@@ -0,0 +1,56 @@
+/**
+ * Codex accounts parked after the app-server refused a turn for an exhausted quota.
+ *
+ * Kept apart from the account rows on purpose. `CodexAccountStatus` is the user's switch —
+ * on or off — and writing a quota refusal into it would show an account the user never
+ * disabled as switched off in Settings, with no way to tell the two apart when it came
+ * back. Parking is the server's own short-lived opinion about an account, so it lives in
+ * memory and lapses on its own.
+ *
+ * In-memory is also the honest lifetime: the park exists to stop a rotation from handing
+ * the next turn straight back to the account that just refused it, and a server restart
+ * re-learns that on the first refusal anyway.
+ */
+
+/** accountId → epoch ms at which the account is worth trying again. */
+const parkedUntil = new Map<string, number>();
+
+/**
+ * How long an account sits out when the refusal carried no reset time.
+ *
+ * Codex's short bucket is five hours, so that is the cheapest correct guess. Guessing long
+ * is safe in a way guessing short is not: an account that recovers early is only skipped
+ * while another one can serve, whereas a park that lapses too early sends the turn back to
+ * an account that refuses it again.
+ */
+const DEFAULT_PARK_MS = 5 * 60 * 60 * 1000;
+
+/** Park an account until its quota resets. `resetAtMs` in the past falls back to the default. */
+export function markCodexAccountUsageLimited(accountId: string, resetAtMs?: number): void {
+  const now = Date.now();
+  const until = resetAtMs != null && resetAtMs > now ? resetAtMs : now + DEFAULT_PARK_MS;
+  parkedUntil.set(accountId, until);
+}
+
+/** Whether the account is still sitting out. Lapsed entries are dropped as they are read. */
+export function isCodexAccountUsageLimited(accountId: string): boolean {
+  const until = parkedUntil.get(accountId);
+  if (until == null) return false;
+  if (until <= Date.now()) { parkedUntil.delete(accountId); return false; }
+  return true;
+}
+
+/** When the account is next worth trying, or null if it is not parked. */
+export function codexUsageLimitResetAt(accountId: string): number | null {
+  return isCodexAccountUsageLimited(accountId) ? parkedUntil.get(accountId)! : null;
+}
+
+/** Let an account back in early — a successful turn proves the park is stale. */
+export function clearCodexAccountUsageLimit(accountId: string): void {
+  parkedUntil.delete(accountId);
+}
+
+/** Test seam: forget every park. */
+export function _resetCodexCooldownsForTesting(): void {
+  parkedUntil.clear();
+}