@jskit-ai/assistant-core 0.2.1 → 0.2.3

package/src/server/conversation/codexHomeStorage.js

@@ -0,0 +1,69 @@
+import { lstat, readdir } from "node:fs/promises";
+import path from "node:path";
+
+// At process start Codex syncs the openai/plugins repository into `.tmp/plugins`
+// and downloads plugin, app and connector catalogues into `cache/`, roughly
+// 100-250 MB per home, refreshed and never pruned. No JSKIT conversation uses
+// plugins or apps (helper and tool-free threads also disable them per thread),
+// so every Codex process JSKIT launches turns both off. Codex's terminal also
+// starts a shared app-server daemon by default (`daemon_auto_start`, 0.163),
+// with a detached updater that keeps it running after the terminal closes; a
+// JSKIT terminal runs its own process or its host's app-server instead.
+const CODEX_DISABLED_PROCESS_FEATURES = Object.freeze(["plugins", "apps", "daemon_auto_start"]);
+
+export function codexDisabledProcessFeatureArguments() {
+  return CODEX_DISABLED_PROCESS_FEATURES.flatMap((feature) => ["-c", `features.${feature}=false`]);
+}
+
+// What those features leave behind (Codex 0.162: core-plugins startup_sync.rs,
+// git_policy.rs, marketplace_policy.rs and remote_catalog_cache.rs; connectors
+// directory_cache.rs and connector_runtime persistence.rs). User-installed
+// plugins under `plugins/` and configured marketplaces are not listed.
+const PLUGIN_AND_APP_ENTRIES = Object.freeze([
+  [".tmp", /^(?:plugins(?:$|[.-])|git-|bundled-marketplaces$)/u],
+  ["cache", /^(?:remote_plugin_catalog|codex_apps_tools|codex_apps_server_info|codex_app_directory|bundled_plugin_exclusions)$/u]
+]);
+
+// A home that will not launch again keeps its auth, config, catalogue, sessions
+// and state/goal/memory/queue/thread-history databases, which retained
+// conversations may still read. Its diagnostic log database and temporary and
+// cache directories serve only a running process; Codex prunes the log database
+// (10 days, 64 MiB) only while it runs.
+const RETIRED_HOME_ENTRIES = /^(?:logs_\d+\.sqlite(?:-wal|-shm)?|\.tmp|cache|tmp)$/u;
+
+async function directoryNames(directory) {
+  try {
+    // Never follow a linked home or subdirectory.
+    if (!(await lstat(directory)).isDirectory()) return [];
+    return await readdir(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+}
+
+/**
+ * Existing Codex-owned entries in `codexHome` that no JSKIT-launched Codex
+ * uses: plugin and app caches, or with `retired: true` everything runtime-only
+ * in a home that will not launch again. Returns sorted absolute paths; a link is
+ * returned as itself. Remove them only while no Codex process uses the home.
+ */
+export async function codexHomeDisposablePaths(codexHome, { retired = false } = {}) {
+  if (typeof codexHome !== "string" || !path.isAbsolute(codexHome)) {
+    throw new TypeError("An absolute Codex home is required.");
+  }
+  const found = [];
+  const names = await directoryNames(codexHome);
+  if (retired) {
+    for (const name of names) {
+      if (RETIRED_HOME_ENTRIES.test(name)) found.push(path.join(codexHome, name));
+    }
+  } else if (names.length) {
+    for (const [directory, pattern] of PLUGIN_AND_APP_ENTRIES) {
+      for (const name of await directoryNames(path.join(codexHome, directory))) {
+        if (pattern.test(name)) found.push(path.join(codexHome, directory, name));
+      }
+    }
+  }
+  return found.sort();
+}

package/src/server/conversation/codexProcess.js

@@ -11,6 +11,7 @@ import { createConversationProcessIdentity } from "./localExecution.js";
 import { isRecord, normalizePositiveInteger } from "@jskit-ai/kernel/shared/support/normalize";
 import { normalizeNullableText } from "./normalize.js";
 import { copyCodexProviderHome, prepareCodexModelCatalog } from "./codexConfiguration.js";
+import { codexDisabledProcessFeatureArguments } from "./codexHomeStorage.js";
 import { startCodexHistoryAdapter } from "./codexHistoryAdapter.js";
 
 const CODEX_APP_SERVER_METADATA_FILE = "runtime.json";
@@ -29,14 +30,16 @@ export async function runCodexAppServerProcess({
   const abortStartup = () => startup.abort();
   process.once("SIGTERM", abortStartup);
   process.once("SIGINT", abortStartup);
+  const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
   const catalogPath = await prepareCodexModelCatalog({
     command,
     runtimeDir,
     bundled,
     additionalModels,
+    codexHome,
     signal: startup.signal
   });
-  const adapter = await startCodexHistoryAdapter({ token, codexHome: process.env.CODEX_HOME || path.join(os.homedir(), ".codex") });
+  const adapter = await startCodexHistoryAdapter({ token, codexHome });
   await writeFile(`${descriptor}.tmp`, JSON.stringify({ baseUrl: adapter.baseUrl, runtimeToken: token }), { mode: 0o600 });
   await rename(`${descriptor}.tmp`, descriptor);
   const child = spawn(command, [...args, "-c", `model_catalog_json=${JSON.stringify(catalogPath)}`], { stdio: "inherit" });
@@ -407,7 +410,7 @@ function codexAppServerRuntimeDirIsManaged(runtimeDir = "") {
     basename.startsWith(`${CODEX_APP_SERVER_RUNTIME_DIR_NAME}-`);
 }
 
-async function removeCodexAppServerRuntimeDir(runtimeDir = "") {
+export async function removeCodexAppServerRuntimeDir(runtimeDir = "") {
   const normalizedRuntimeDir = normalizeNullableText(runtimeDir);
   if (!codexAppServerRuntimeDirIsManaged(normalizedRuntimeDir)) {
     return false;
@@ -1231,6 +1234,8 @@ export function createCodexAppServerRuntime({ execution, credentials, configurat
       ]),
       "-c",
       "check_for_update_on_startup=false",
+      // Plugin and app startup syncs fill the home with unused catalogues.
+      ...codexDisabledProcessFeatureArguments(),
       ...(projectTrustOverride
         ? [
             "-c",

package/src/server/conversation/codexProvider.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { lstat, realpath } from "node:fs/promises";
 import path from "node:path";
 import { CodexAppServerJsonRpcClient } from "./codexClient.js";
+import { releaseSupersededCodexRuntime } from "./codexProviderOwner.js";
 import {
   createCodexAccountReader, codexAuthOutputRequiresReconnect, codexAppServerProjectHookTrustConfig,
   codexAppServerTextHasControlCharacters, CODEX_APP_SERVER_ACCOUNT_ID_MAX_LENGTH
@@ -43,8 +44,6 @@ const CODEX_APP_SERVER_THREAD_INVENTORY_PAGE_LIMIT = 100;
 const CODEX_APP_SERVER_THREAD_INVENTORY_MAX_PAGES = 100;
 export const CODEX_APP_SERVER_THREAD_INVENTORY_MAX_COUNT = 1000;
 export const CODEX_APP_SERVER_THREAD_INVENTORY_ID_MAX_LENGTH = 512;
-const CODEX_APP_SERVER_THREAD_INVENTORY_MAX_ENTRY_BYTES = 64 * 1024;
-const CODEX_APP_SERVER_THREAD_INVENTORY_MAX_TOTAL_BYTES = 2 * 1024 * 1024;
 const CODEX_APP_SERVER_HELPER_MAX_MESSAGE_BYTES = 4 * 1024 * 1024;
 const CODEX_APP_SERVER_SERVER_INFO_USER_AGENT_MAX_LENGTH = 512;
 const CODEX_APP_SERVER_CHATGPT_REFRESH_METHOD = "account/chatgptAuthTokens/refresh";
@@ -337,8 +336,12 @@ async function ensureCodexAppServerThread({
     throw new Error("Codex app-server did not return a thread id.");
   }
   stageStartedAt = Date.now();
-  await identity.write({ appServerRuntime, threadId, workdir: normalizedWorkdir,
+  const recorded = await identity.write({ appServerRuntime, threadId, workdir: normalizedWorkdir,
     ...(toolConfiguration ? { toolSchemaIdentity: toolConfiguration.toolSchemaIdentity } : {}) });
+  // The session no longer uses the runtime directory it recorded before (an
+  // earlier sign-in's). Releasing it is cleanup: a failure keeps the directory.
+  const superseded = normalizeAgentText(recorded?.supersededRuntimeDir);
+  if (superseded) await releaseSupersededCodexRuntime(superseded).catch(() => null);
   if (providerReady) await providerReady({ provider, threadId });
   onStage({ durationMs: Date.now() - stageStartedAt, stage: "identity-metadata" });
   return {
@@ -570,6 +573,7 @@ async function listBoundedCodexAppServerThreadIds({
   client,
   cwd = "",
   errorCode = "",
+  findThreadId = "",
   label = "",
   requestLabel = "",
   runRequest,
@@ -603,43 +607,35 @@ async function listBoundedCodexAppServerThreadIds({
       }, { signal }),
       requestLabel
     );
-    if (
-      !Array.isArray(response?.data) ||
-      response.data.length > CODEX_APP_SERVER_THREAD_INVENTORY_PAGE_LIMIT ||
-      state.entryCount + response.data.length > CODEX_APP_SERVER_THREAD_INVENTORY_MAX_COUNT
-    ) {
-      throw codexAppServerThreadInventoryError(
-        errorCode,
-        label,
-        "exceeded its entry limit"
-      );
+    if (!Array.isArray(response?.data) || response.data.length > CODEX_APP_SERVER_THREAD_INVENTORY_PAGE_LIMIT) {
+      throw codexAppServerThreadInventoryError(errorCode, label, "returned a malformed page");
+    }
+    // Only thread ids are retained, so only they are bounded. A search for one
+    // thread retains none and is bounded by the page limit alone.
+    if (!findThreadId && state.entryCount + response.data.length > CODEX_APP_SERVER_THREAD_INVENTORY_MAX_COUNT) {
+      throw codexAppServerThreadInventoryError(errorCode, label,
+        `exceeded its ${CODEX_APP_SERVER_THREAD_INVENTORY_MAX_COUNT}-thread limit`);
     }
     for (const entry of response.data) {
-      const threadId = normalizeAgentText(entry?.id);
-      const threadCwd = normalizeAgentText(entry?.cwd);
-      let entryBytes = 0;
-      try {
-        entryBytes = Buffer.byteLength(JSON.stringify(entry), "utf8");
-      } catch {
-        entryBytes = CODEX_APP_SERVER_THREAD_INVENTORY_MAX_ENTRY_BYTES + 1;
+      const threadId = isRecord(entry) ? normalizeAgentText(entry.id) : "";
+      const refusal = !isRecord(entry) ? "listed an entry that is not a thread"
+        : !threadId ? "listed a thread without an id"
+          : threadId.length > CODEX_APP_SERVER_THREAD_INVENTORY_ID_MAX_LENGTH
+            ? `listed a thread id longer than ${CODEX_APP_SERVER_THREAD_INVENTORY_ID_MAX_LENGTH} characters`
+            : codexAppServerTextHasControlCharacters(threadId) ? "listed a thread id with control characters"
+              : verifyCwd && normalizeAgentText(entry.cwd) !== cwd
+                ? `listed thread ${threadId} outside the requested directory` : "";
+      if (refusal) {
+        throw codexAppServerThreadInventoryError(errorCode, label, refusal);
       }
-      if (
-        !isRecord(entry) ||
-        !threadId ||
-        threadId.length > CODEX_APP_SERVER_THREAD_INVENTORY_ID_MAX_LENGTH ||
-        codexAppServerTextHasControlCharacters(threadId) ||
-        (verifyCwd && threadCwd !== cwd) ||
-        entryBytes > CODEX_APP_SERVER_THREAD_INVENTORY_MAX_ENTRY_BYTES ||
-        state.totalBytes + entryBytes > CODEX_APP_SERVER_THREAD_INVENTORY_MAX_TOTAL_BYTES
-      ) {
-        throw codexAppServerThreadInventoryError(
-          errorCode,
-          label,
-          "contained an invalid entry"
-        );
+      if (findThreadId) {
+        if (threadId === findThreadId) {
+          state.found = true;
+          return state;
+        }
+        continue;
       }
       state.entryCount += 1;
-      state.totalBytes += entryBytes;
       state.threadIds.add(threadId);
     }
     const nextCursor = response.nextCursor === undefined || response.nextCursor === null || response.nextCursor === ""
@@ -734,6 +730,7 @@ export class CodexAppServerAgentProvider {
     this.planUsagePending = null;
     this.planUsageAuthGeneration = 0;
     this.availabilityPromise = null;
+    this.stale = false;
     this.options = options;
     this.client = null;
     this.connectPromise = null;
@@ -955,7 +952,22 @@ export class CodexAppServerAgentProvider {
     }
   }
 
+  // An account change leaves a runtime that is still working on the
+  // credentials it started with. Codex reads them once, so this provider
+  // finishes its running turn on them and then stops; it never re-checks,
+  // replaces or restarts its runtime, and never marks the new account invalid.
+  markStale() {
+    this.stale = true;
+  }
+
+  staleRuntimeError() {
+    return Object.assign(new Error("Codex (OpenAI) changed account. Send your message again."), {
+      code: `${this.errorPrefix}codex_account_changed`, retryable: true
+    });
+  }
+
   async prepareRuntime() {
+    if (this.stale) throw this.staleRuntimeError();
     const previousRuntime = this.runtime;
     const nextRuntime = await this.host.runtime.ensure(this.host.parameters);
     if (this.options.modelProviderId) nextRuntime.modelProviderId = this.options.modelProviderId;
@@ -997,7 +1009,7 @@ export class CodexAppServerAgentProvider {
   }
 
   async assertRuntimeAuthReady(reason = "codex-app-server") {
-    if (this.isHelperProvider()) {
+    if (this.isHelperProvider() || this.stale) {
       return;
     }
     const runtime = this.runtime || {};
@@ -1047,7 +1059,7 @@ export class CodexAppServerAgentProvider {
         error?.observed || "",
         await tailTextFile(this.runtime?.logPath || "")
       ].filter(Boolean).join("\n");
-      if (codexAuthOutputRequiresReconnect(observed)) {
+      if (!this.stale && codexAuthOutputRequiresReconnect(observed)) {
         const runtime = this.runtime || {};
         if (runtime.runtimeDir) {
           await this.stopRuntimeAndRequireDrain(reason);
@@ -1355,6 +1367,7 @@ export class CodexAppServerAgentProvider {
 
   async ensureAvailable({ modelProviderId = "" } = {}) {
     if (this.observationFailure) throw this.observationFailure;
+    if (this.stale && !this.isAvailable()) throw this.staleRuntimeError();
     if (this.isAvailable()) {
       return {
         client: this.client,
@@ -1843,8 +1856,7 @@ export class CodexAppServerAgentProvider {
       signal,
       state: {
         entryCount: 0,
-        threadIds: new Set(),
-        totalBytes: 0
+        threadIds: new Set()
       },
       verifyCwd: true
     });
@@ -1863,7 +1875,7 @@ export class CodexAppServerAgentProvider {
       throw new TypeError("Codex descendant inventory requires an exact thread id.");
     }
     const client = await this.activeClient();
-    const state = { entryCount: 0, threadIds: new Set(), totalBytes: 0 };
+    const state = { entryCount: 0, threadIds: new Set() };
     for (const archived of [false, true]) {
       await listBoundedCodexAppServerThreadIds({
         ancestorThreadId, archived, client, state,
@@ -1878,7 +1890,7 @@ export class CodexAppServerAgentProvider {
   async listNativeThreadsForCwd(cwd) {
     if (!path.isAbsolute(cwd || "") || codexAppServerTextHasControlCharacters(cwd)) throw new TypeError("Native inventory requires an exact absolute directory.");
     const client = await this.activeClient();
-    const state = { entryCount: 0, threadIds: new Set(), totalBytes: 0 };
+    const state = { entryCount: 0, threadIds: new Set() };
     for (const archived of [false, true]) {
       await listBoundedCodexAppServerThreadIds({ archived, client, cwd, state, verifyCwd: true,
         sourceKinds: CODEX_NATIVE_STORAGE_SOURCE_KINDS,
@@ -1894,13 +1906,13 @@ export class CodexAppServerAgentProvider {
       throw new TypeError("Native existence checks require an exact thread id.");
     }
     const client = await this.activeClient();
-    const state = { entryCount: 0, threadIds: new Set(), totalBytes: 0 };
+    const state = { entryCount: 0, found: false, threadIds: new Set() };
     for (const archived of [false, true]) {
-      await listBoundedCodexAppServerThreadIds({ archived, client, state, signal,
+      await listBoundedCodexAppServerThreadIds({ archived, client, findThreadId: id, state, signal,
         sourceKinds: CODEX_NATIVE_STORAGE_SOURCE_KINDS,
         errorCode: `${this.errorPrefix}codex_retirement_inventory_invalid`, label: "native storage",
         requestLabel: "codex-app-server-native-existence", runRequest: this.runRequest.bind(this) });
-      if (state.threadIds.has(id)) return true;
+      if (state.found) return true;
     }
     return false;
   }
@@ -1912,8 +1924,7 @@ export class CodexAppServerAgentProvider {
     const execution = await this.currentHelperExecutionContext();
     const state = {
       entryCount: 0,
-      threadIds: new Set(),
-      totalBytes: 0
+      threadIds: new Set()
     };
     for (const archived of [false, true]) {
       await listBoundedCodexAppServerThreadIds({