@hienlh/ppm 0.20.2 → 0.20.4

package/docs/lessons-learned.md

@@ -4,6 +4,20 @@ Knowledge and gotchas discovered during PPM development.
 
 ---
 
+## A missing Codex rollout must not restart an existing conversation
+
+Each Codex account has its own history directory. Search all managed accounts,
+preferring the session's current account, and copy the located rollout into the
+serving account's directory before resuming. Only a session freshly created by
+PPM may start a new thread without a rollout. An existing thread with missing
+history must report an error, including during account rotation.
+
+Starting a replacement thread and recording `migrated_to` hides the original
+history behind the replacement while a tab can retain the original title.
+For affected historical data, verify both transcripts and the migration log,
+take a verified SQLite snapshot, then remove only the incorrect redirect.
+Keep both transcripts; verify the live messages API returns each independently.
+
 ## Chat usage must stay scoped to its provider and session
 
 Usage API responses are snapshots: replace them instead of merging into previous

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "SEE LICENSE IN LICENSE",

package/src/providers/codex-app-server/codex-event-mapper.ts

@@ -168,6 +168,10 @@ export function mapCodexEvent(notif: Notif, sessionId: string): ChatEvent[] {
       return typeof p.delta === "string" ? [{ type: "text", content: p.delta }] : [];
 
     case "item/reasoning/textDelta":
+    // `summary` is what turn/start requests for PPM's Thinking switch. Recent
+    // app-server builds stream it under this method, while older builds used
+    // textDelta directly. Both are safe, user-visible reasoning summaries.
+    case "item/reasoning/summaryTextDelta":
       return typeof p.delta === "string" ? [{ type: "thinking", content: p.delta }] : [];
 
     case "item/started": {

package/src/providers/codex-app-server/codex-history.ts

@@ -411,10 +411,12 @@ export function getRolloutMessages(sessionsDir: string, threadId: string, reques
   } catch { return []; }
 }
 
-/** True when a path points at a codex rollout under ~/.codex/sessions. */
+/** True when a path points at a codex rollout in the ambient or a PPM account home. */
 export function isCodexRolloutPath(p: string): boolean {
   const n = normPath(p);
-  return n.endsWith(".jsonl") && n.includes(normPath(join(homedir(), ".codex", "sessions")));
+  const ambient = normPath(join(homedir(), ".codex", "sessions"));
+  const managed = normPath(join(homedir(), ".ppm", "codex-accounts"));
+  return n.endsWith(".jsonl") && (n.includes(ambient) || (n.includes(managed) && n.includes("/sessions/")));
 }
 
 /**

package/src/providers/codex-app-server/codex-protocol.ts

@@ -56,6 +56,10 @@ export interface TurnStartParams {
   approvalPolicy?: AskForApproval;
   sandboxPolicy?: unknown;
   model?: string;
+  /** Codex's per-turn reasoning depth (low through ultra, model dependent). */
+  effort?: string;
+  /** Controls whether Codex streams a safe reasoning summary to the client. */
+  summary?: "none" | "auto" | "concise" | "detailed";
 }
 
 // ── Decisions (approval responses) ──

package/src/providers/codex-app-server/codex-provider.ts

@@ -10,7 +10,7 @@ import type {
   UsageInfo,
 } from "../provider.interface.ts";
 import { configService } from "../../services/config.service.ts";
-import { setSessionMetadata, getSessionProjectPath, setSessionProvider, setSessionCodexAccount, getSessionCodexAccount, getSessionTitles } from "../../services/db.service.ts";
+import { setSessionMetadata, getSessionProjectPath, setSessionProvider, setSessionCodexAccount, getSessionCodexAccount, getSessionTitles, insertTurnUsage } from "../../services/db.service.ts";
 import {
   resolveCodexAccountForSession,
   getCodexAccount,
@@ -29,6 +29,7 @@ import { join } from "node:path";
 import { CodexJsonRpcClient, CONTROL_REQUEST_TIMEOUT_MS } from "./codex-jsonrpc-client.ts";
 import { permissionModeToCodex, type CodexPermission } from "./codex-permission-map.ts";
 import { mapCodexEvent, parseTokenUsage } from "./codex-event-mapper.ts";
+import { subagentCardId } from "./codex-subagent-thread.ts";
 import { decisionFor, isApprovalMethod, type ApprovalMethod } from "./codex-approval-decision.ts";
 import { parseModelList } from "./codex-model-parser.ts";
 import { getOrFetchUsage, registerUsageSource } from "../../services/provider-usage/usage-registry.ts";
@@ -147,6 +148,8 @@ interface LiveSession {
   compactRequested?: boolean;
   /** Token counts from the most recent usage notification, attached to `done`. */
   lastUsage?: import("../../shared/turn-usage.ts").TurnUsage;
+  /** Spawned thread ids. Notifications from these threads belong inside their Agent card. */
+  subagentThreadIds: Set<string>;
   /** A turn is running on the thread. Codex accepts exactly one at a time: a
    *  second `turn/start` resolves with the ALREADY-RUNNING turn (same id,
    *  status `inProgress`) and silently discards the new input — no error, so
@@ -219,6 +222,21 @@ function createEventChannel(): EventChannel {
   };
 }
 
+/** The app-server puts the owner thread on every item notification.  An
+ * `agentThreadId` inside a SubAgentActivity is the newly spawned child, so it
+ * must never be used here: that would nest the launch card inside itself. */
+export function threadIdFromNotification(params: unknown): string | null {
+  if (!params || typeof params !== "object") return null;
+  const p = params as Record<string, unknown>;
+  const direct = p.threadId ?? p.thread_id;
+  if (typeof direct === "string" && direct) return direct;
+  const thread = p.thread;
+  if (thread && typeof thread === "object" && typeof (thread as Record<string, unknown>).id === "string") {
+    return (thread as Record<string, unknown>).id as string;
+  }
+  return null;
+}
+
 /**
  * Drop a model id that isn't a codex model. PPM's per-session model can fall back
  * to the global Claude default (e.g. `claude-opus-4-8`), which codex rejects
@@ -235,6 +253,10 @@ function extractThreadId(result: unknown): string | null {
   return r?.thread?.id ?? r?.threadId ?? r?.id ?? null;
 }
 
+function missingRolloutError(sessionId: string): Error {
+  return new Error(`Cannot resume Codex session ${sessionId}: its transcript was not found in the available account homes for this project. Restore the original account/transcript and retry, or explicitly open a new chat.`);
+}
+
 /** Human label for an approval prompt (dormant in MVP under default bypass). */
 function approvalToolLabel(method: string, params: unknown): string {
   const p = (params && typeof params === "object" ? params : {}) as Record<string, unknown>;
@@ -273,6 +295,8 @@ export class CodexAppServerProvider implements AIProvider {
   readonly name = "Codex";
 
   private sessions = new Map<string, Session>();
+  /** Only IDs minted here may start a thread. Missing history is never proof of a new chat. */
+  private unstartedSessions = new Set<string>();
   private live = new Map<string, LiveSession>();
   private modelsCache: { models: ModelOption[]; expiry: number } | null = null;
   /** Keyed by `cwd\0codexHome` — skills differ per workspace AND per account. */
@@ -294,6 +318,7 @@ export class CodexAppServerProvider implements AIProvider {
       createdAt: new Date().toISOString(),
     };
     this.sessions.set(id, session);
+    this.unstartedSessions.add(id);
     if (config.projectPath) setSessionMetadata(id, config.projectName, config.projectPath);
     return session;
   }
@@ -354,6 +379,7 @@ export class CodexAppServerProvider implements AIProvider {
   async deleteSession(sessionId: string): Promise<void> {
     this.abortQuery(sessionId, "delete");
     this.sessions.delete(sessionId);
+    this.unstartedSessions.delete(sessionId);
   }
 
   // ── Streaming (multi-turn) ──
@@ -363,6 +389,7 @@ export class CodexAppServerProvider implements AIProvider {
       try {
         live = await this.connect(sessionId, opts);
       } catch (err) {
+        this.abortQuery(sessionId, "connect_failed");
         yield { type: "error", message: redactTruncate((err as Error)?.message ?? String(err), 512) };
         yield { type: "done", sessionId, resultSubtype: "error_during_execution" };
         return;
@@ -416,6 +443,7 @@ export class CodexAppServerProvider implements AIProvider {
     live.lastTurnInput = { message, opts };
     live.currentAssistant = "";
     live.currentEvents = [];
+    live.lastUsage = undefined;
     // Codex takes an image as a path, never as a payload, so the uploaded copy is what it
     // gets. Images lead: the text usually refers to them ("what is this?").
     const input: UserInput[] = [
@@ -423,10 +451,17 @@ export class CodexAppServerProvider implements AIProvider {
       { type: "text" as const, text: message, text_elements: [] },
     ];
     const turnModel = codexModel(opts?.model);
+    const turnEffort = opts?.effort ?? this.config?.effort;
+    const configuredThinking = this.config?.thinking_budget_tokens;
+    // Codex does not accept a token budget. Its equivalent is an effort level,
+    // while `summary` controls the safe thinking text the UI can show.
+    const thinkingEnabled = (opts?.thinkingBudget ?? configuredThinking ?? -1) !== 0;
     live.client.request("turn/start", {
       threadId: live.threadId,
       input,
       ...(turnModel ? { model: turnModel } : {}),
+      ...(turnEffort ? { effort: turnEffort } : {}),
+      summary: thinkingEnabled ? "detailed" : "none",
     }).then((res) => {
       // Backup for the `turn/started` notification, which is what normally names
       // the turn — an interrupt arriving in between has nothing to address.
@@ -586,6 +621,11 @@ export class CodexAppServerProvider implements AIProvider {
    * had just been repaired.
    */
   private async respawnOn(live: LiveSession, threadId: string, account: CodexAccount): Promise<void> {
+    // Validate before replacing the client or its account binding. A missing file
+    // can mean inaccessible history, including on the first turn; it cannot justify
+    // migrating an existing provider thread onto an empty conversation.
+    const found = locateRollout(threadId, live.cwd);
+    if (!found) throw missingRolloutError(threadId);
     const old = live.client;
     old.onNotification(() => {});
     old.onServerRequest(() => {});
@@ -596,8 +636,8 @@ export class CodexAppServerProvider implements AIProvider {
     if (process.platform === "win32" && pid) killProcessTree(pid);
     else if (proc) setTimeout(() => { try { proc.kill("SIGKILL"); } catch { /* dead */ } }, 2000).unref?.();
 
-    // Written before the rollout lookup so the new account's own directory is searched
-    // first — on a second rotation that is where the freshest history sits.
+    // Locate history while the outgoing account is still bound, so its current
+    // transcript wins. Then bind the account that will receive the localized copy.
     setSessionCodexAccount(threadId, account.id);
 
     const client = new CodexJsonRpcClient();
@@ -616,26 +656,7 @@ export class CodexAppServerProvider implements AIProvider {
       approvalPolicy: live.permission.approvalPolicy,
       ...(live.model ? { model: live.model } : {}),
     };
-    const found = locateRollout(threadId, live.cwd);
-    if (found) {
-      await this.resumeThread(client, threadId, found, account.home, resumeBase);
-      return;
-    }
-    // No rollout yet means the limit hit the very first turn, before codex had written one.
-    // There is nothing to resume, so the thread starts fresh — and it comes back under a
-    // new id, which every map keyed by the old one has to learn about or the next turn is
-    // sent to a thread this app-server has never heard of.
-    const started = await client.request("thread/start", resumeBase);
-    const newId = extractThreadId(started);
-    if (!newId || newId === threadId) return;
-    live.threadId = newId;
-    this.live.set(newId, live);
-    const meta = this.sessions.get(threadId);
-    if (meta) { this.sessions.delete(threadId); meta.id = newId; this.sessions.set(newId, meta); }
-    setSessionMetadata(newId, meta?.projectName, live.cwd);
-    setSessionProvider(newId, this.id);
-    setSessionCodexAccount(newId, account.id);
-    live.channel.push({ type: "session_migrated", oldSessionId: threadId, newSessionId: newId });
+    await this.resumeThread(client, threadId, found, account.home, resumeBase);
   }
 
   /**
@@ -672,13 +693,18 @@ export class CodexAppServerProvider implements AIProvider {
     const permission = permissionModeToCodex(opts?.permissionMode ?? this.config?.permission_mode);
     const model = codexModel(opts?.model ?? this.config?.model);
 
+    // Only resume a rollout attributable to this project. An unknown/resumed ID
+    // without one must not silently become a fresh thread with a different identity.
+    const found = locateRollout(sessionId, cwd);
+    if (!found && !this.unstartedSessions.has(sessionId)) throw missingRolloutError(sessionId);
+
     const client = new CodexJsonRpcClient();
     const channel = createEventChannel();
     const live: LiveSession = {
       client, threadId: null, cwd, channel, permission, model,
       pendingApprovals: new Map(), answeredCodexIds: new Set(),
       history: [], transcript: [], currentAssistant: "", currentEvents: [],
-      pendingTurns: [],
+      pendingTurns: [], subagentThreadIds: new Set(),
     };
     this.live.set(sessionId, live);
 
@@ -697,13 +723,13 @@ export class CodexAppServerProvider implements AIProvider {
     const resumeBase = { cwd, sandbox: permission.sandbox, approvalPolicy: permission.approvalPolicy, ...(model ? { model } : {}) };
     // Only treat as a resume when a rollout for this id is attributable to THIS
     // project (fail-closed cwd guard) — never resume another project's thread.
-    const found = locateRollout(sessionId, cwd);
     const result = found
       ? await this.resumeThread(client, sessionId, found, account?.home, resumeBase)
       : await client.request("thread/start", resumeBase);
 
     const threadId = extractThreadId(result) ?? (found ? sessionId : null);
     if (!threadId) throw new Error("codex thread/start returned no thread id");
+    this.unstartedSessions.delete(sessionId);
     live.threadId = threadId;
 
     if (threadId !== sessionId) {
@@ -750,14 +776,26 @@ export class CodexAppServerProvider implements AIProvider {
       const usage = parseTokenUsage(notif.params, live.model);
       if (usage) live.lastUsage = usage;
     }
+    const notificationThreadId = threadIdFromNotification(notif.params);
+    const parentToolUseId = notificationThreadId && live.subagentThreadIds.has(notificationThreadId)
+      ? subagentCardId(notificationThreadId)
+      : undefined;
     const events = mapCodexEvent(notif, live.threadId ?? "");
     for (const ev of events) {
       // The counts arrive on their own notification just before the turn ends,
       // so `done` is where they become visible to a consumer.
-      if (ev.type === "done" && live.lastUsage) ev.usage = live.lastUsage;
-      live.channel.push(ev);
+      if (ev.type === "done" && live.lastUsage) {
+        ev.usage = live.lastUsage;
+        this.recordTurnUsage(live, live.lastUsage);
+      }
+      const nested = parentToolUseId ? { ...ev, parentToolUseId } as ChatEvent : ev;
+      live.channel.push(nested);
       // Accumulate tool calls into the turn so getMessages (live) keeps them.
-      if (ev.type === "tool_use" || ev.type === "tool_result") live.currentEvents.push(ev);
+      if (nested.type === "tool_use" || nested.type === "tool_result") live.currentEvents.push(nested);
+      if (nested.type === "tool_use" && nested.tool === "Agent" && typeof nested.toolUseId === "string"
+          && nested.toolUseId.startsWith("subagent-")) {
+        live.subagentThreadIds.add(nested.toolUseId.slice("subagent-".length));
+      }
     }
     if (notif.method === "turn/completed") {
       if (live.currentAssistant || live.currentEvents.length) {
@@ -798,6 +836,32 @@ export class CodexAppServerProvider implements AIProvider {
     }
   }
 
+  /** Persist Codex's per-turn token and prompt-cache split for the debug panel. */
+  private recordTurnUsage(live: LiveSession, usage: import("../../shared/turn-usage.ts").TurnUsage): void {
+    const accountId = live.threadId ? getSessionCodexAccount(live.threadId) ?? undefined : undefined;
+    const account = accountId ? getCodexAccount(accountId) : null;
+    try {
+      insertTurnUsage({
+        sessionId: live.threadId ?? "",
+        model: usage.model,
+        inputTokens: usage.inputTokens,
+        outputTokens: usage.outputTokens,
+        cacheReadTokens: usage.cacheReadTokens,
+        cacheWriteTokens: usage.cacheWriteTokens,
+        contextWindow: usage.contextWindow,
+        costUsd: usage.costUsd,
+        // A cache miss alone does not prove a process restart: a first turn and
+        // an evicted prompt cache look the same on the wire. Keep this false
+        // until the provider has an explicit lifecycle reason to record.
+        coldStart: false,
+        ...(accountId ? { accountId } : {}),
+        ...(account?.label ? { accountLabel: account.label } : {}),
+      });
+    } catch (err) {
+      console.warn(`[usage] failed to persist codex usage: ${(err as Error).message}`);
+    }
+  }
+
   private handleServerRequest(live: LiveSession, req: ServerRequest): void {
     const method = req.method;
     if (isApprovalMethod(method)) {

package/src/server/routes/chat.ts

@@ -19,6 +19,8 @@ import { parseJsonlTranscript, validateJsonlPath } from "../../services/jsonl-tr
 import { aggregateTasks } from "../../services/task-status-aggregator.ts";
 import { MANY_IMAGE_DIMENSION_LIMIT, type StripMode } from "../../services/transcript-images.ts";
 import { auditTranscriptImagesFile, stripTranscriptImagesFile } from "../../services/transcript-images-file.ts";
+import { listCodexAccounts } from "../../services/codex-account.service.ts";
+import { findRolloutByThreadId } from "../../providers/codex-app-server/codex-history.ts";
 import { getSessionProjectPath, setSessionMetadata, setSessionTitle, getSessionTitle, getPinnedSessionIds, pinSession, unpinSession, deleteSessionMapping, deleteSessionMetadata, deleteSessionTitle, getAllUnread, clearSessionUnread, setSessionUnread } from "../../services/db.service.ts";
 import { setSessionTag, bulkSetSessionTag, getTagById, getSessionTags, getProjectDefaultTagId } from "../../services/tag.service.ts";
 import { recordBranch, resolveVersionGroup, resolveVersionMap, collapseTreesToHeads, hasChildren, deleteBranchesFor, getRootId } from "../../services/session-branch.service.ts";
@@ -469,8 +471,11 @@ chatRoutes.patch("/sessions/:id", async (c) => {
     const projectPath = c.get("projectPath");
     // Persist to PPM DB (authoritative source for user-set titles)
     setSessionTitle(id, title);
-    // Also persist to SDK so Claude Code CLI sees the custom title
-    await sdkRenameSession(id, title, { dir: projectPath });
+    // Codex owns its rollout title and has no Claude SDK session to rename.
+    // PPM's title table is the authoritative title for both providers.
+    if (getSessionProvider(id) !== "codex") {
+      await sdkRenameSession(id, title, { dir: projectPath });
+    }
     // Also update in-memory session
     const session = chatService.getSession(id);
     if (session) session.title = title;
@@ -763,9 +768,22 @@ chatRoutes.get("/sessions/:id/logs", (c) => {
  */
 function resolveSessionJsonlPath(sessionId: string): { jsonlPath: string; jsonlDir: string; projectPath: string; exists: boolean } {
   const homedir = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  const providerId = getSessionProvider(sessionId);
+  const storedProjectPath = getSessionProjectPath(sessionId) ?? "";
+  if (providerId === "codex") {
+    const dirs = [
+      ...listCodexAccounts().map((account) => join(account.home, "sessions")),
+      ...(homedir ? [resolve(homedir, ".codex", "sessions")] : []),
+    ];
+    for (const dir of dirs) {
+      const found = findRolloutByThreadId(dir, sessionId, storedProjectPath || undefined);
+      if (found) return { jsonlPath: found, jsonlDir: dir, projectPath: storedProjectPath, exists: true };
+    }
+    return { jsonlPath: "", jsonlDir: "", projectPath: storedProjectPath, exists: false };
+  }
   const provider = providerRegistry.get("claude") as any;
   const projectPath = provider?.activeSessions?.get(sessionId)?.projectPath
-    ?? getSessionProjectPath(sessionId)
+    ?? storedProjectPath
     ?? "";
   const projectsRoot = homedir ? resolve(homedir, ".claude", "projects") : "";
   // SDK encodes cwd by replacing path separators + drive colon with "-".
@@ -815,6 +833,7 @@ chatRoutes.get("/sessions/:id/debug", (c) => {
   return c.json(ok({
     ppmSessionId: sessionId,
     sdkSessionId: sessionId,
+    providerId: getSessionProvider(sessionId) ?? "claude",
     sessionId,
     jsonlPath: exists ? jsonlPath : null,
     jsonlDir,

package/src/server/ws/chat.ts

@@ -1286,10 +1286,15 @@ export const chatWebSocket = {
       } else {
         // Follow-up: push into existing generator via provider
         if (provider && "pushMessage" in provider && parsed.type === "message") {
+          const effort = getSessionEffort(sessionId) ?? undefined;
+          const thinkingBudget = getSessionThinking(sessionId);
           (provider as any).pushMessage(sessionId, parsed.content, {
             priority: parsed.priority ?? 'next',
             images: parsed.images,
             imagePaths: parsed.imagePaths,
+            ...(entry.model ? { model: entry.model } : {}),
+            ...(effort ? { effort } : {}),
+            ...(thinkingBudget != null ? { thinkingBudget } : {}),
           });
         }
         // Clear turn events for new turn display + transition phase