@jskit-ai/assistant-core 0.2.2 → 0.2.3

package/src/server/conversation/codexProviderOwner.js

@@ -2,6 +2,11 @@ import path from "node:path";
 import { stat } from "node:fs/promises";
 import { CodexAppServerAgentProvider } from "./codexProvider.js";
 import { codexAppServerProjectHookTrustConfig } from "./codexConfiguration.js";
+import {
+  CODEX_APP_SERVER_PROCESS_STATE,
+  readCodexAppServerMetadata,
+  removeCodexAppServerRuntimeDir
+} from "./codexProcess.js";
 import { normalizeCodexRunText as normalizeText } from "./codexTurnState.js";
 
 // Moved from Vibe64's codexTerminal provider owner. Caller-local provider keys
@@ -10,6 +15,8 @@ import { normalizeCodexRunText as normalizeText } from "./codexTurnState.js";
 const codexAppServerProviders = new Map();
 const codexAppServerOwnedRuntimes = new Map();
 const codexAppServerRuntimeLifecycles = new Map();
+// Runtimes an account change left running a turn, by native runtime identity.
+const codexAppServerStaleRuntimes = new Map();
 
 export function codexAppServerOwnedRuntimeKey(providerKey = "", providerOptions = {}) {
   const runtimeDir = normalizeText(providerOptions?.runtimeDir);
@@ -30,6 +37,31 @@ function withRuntimeLifecycle(runtimeKey, operation) {
   return run;
 }
 
+// A session recorded a new runtime directory (a new sign-in gets its own), so
+// its previous one is no longer used. It goes once its runtime has verifiably
+// stopped; a stale runtime still finishing its turn drops it when it stops.
+// Helper cleanup treats an absent directory as retired, which is also what it
+// does with a previous sign-in's runtime it finds stopped.
+export function releaseSupersededCodexRuntime(runtimeDir = "") {
+  const runtimeKey = codexAppServerOwnedRuntimeKey("", { runtimeDir });
+  return withRuntimeLifecycle(runtimeKey, async () => {
+    const stale = codexAppServerStaleRuntimes.get(runtimeKey);
+    if (stale) {
+      stale.superseded = true;
+      return { deferred: true, removed: false };
+    }
+    if (codexAppServerOwnedRuntimes.has(runtimeKey) || [...providerRecords()].some(record =>
+      codexAppServerOwnedRuntimeKey(record.providerKey, record.providerOptions) === runtimeKey)) {
+      return { removed: false };
+    }
+    const metadata = await readCodexAppServerMetadata(runtimeDir);
+    if (metadata?.processState !== CODEX_APP_SERVER_PROCESS_STATE.STOPPED || !metadata.processExitVerifiedAt) {
+      return { removed: false };
+    }
+    return { removed: await removeCodexAppServerRuntimeDir(runtimeDir) };
+  });
+}
+
 export function codexAppServerRuntimeStopWasVerified(result = {}) {
   return result?.stopped === true ||
     result?.processExitVerified === true ||
@@ -51,6 +83,31 @@ function* providerRecords() {
   for (const records of codexAppServerProviders.values()) yield* records.values();
 }
 
+function nativeRequest(client, method, params) {
+  return client.request(method, params, { signal: AbortSignal.timeout(5_000) });
+}
+
+// The loaded threads of one native runtime that have a running turn, read from
+// the runtime itself so Temporary, Main and native terminal turns all count.
+async function runningNativeThreads(peers) {
+  const client = peers.find(record => record.provider.client?.isOpen?.())?.provider.client;
+  if (!client) return [];
+  const running = [];
+  const seen = new Set();
+  let cursor;
+  do {
+    const page = await nativeRequest(client, "thread/loaded/list", { limit: 100, ...(cursor ? { cursor } : {}) });
+    for (const threadId of Array.isArray(page?.data) ? page.data : []) {
+      const { thread } = await nativeRequest(client, "thread/read", { threadId, includeTurns: false });
+      if ((typeof thread?.status === "string" ? thread.status : thread?.status?.type) === "active") running.push(threadId);
+    }
+    cursor = page?.nextCursor;
+    if (cursor && seen.has(cursor)) throw new Error("Codex's loaded-thread inventory did not finish.");
+    if (cursor) seen.add(cursor);
+  } while (cursor);
+  return running;
+}
+
 /** Internal consumer view of the one native provider owner, not a server per view. */
 export function createCodexAppServerProviderOwner({
   runtimeRoot = "",
@@ -217,7 +274,14 @@ export function createCodexAppServerProviderOwner({
           current.executionRoot === identity.executionRoot &&
           current.runtimeInstanceId === identity.runtimeInstanceId &&
           current.workdir === identity.workdir) {
-        await retireAndCloseProvider(currentKey);
+        const record = records.get(currentKey);
+        if (!record?.provider.stale) {
+          await retireAndCloseProvider(currentKey);
+          continue;
+        }
+        // A stale runtime whose turn has ended stops before the session's next
+        // runtime starts, so its threads are never loaded in two runtimes at once.
+        await retireStaleRuntime(codexAppServerOwnedRuntimeKey(currentKey, record.providerOptions)).catch(() => null);
       }
     }
     context.assertAdmission();
@@ -277,7 +341,7 @@ export function createCodexAppServerProviderOwner({
     return provider;
   }
 
-  // A conversation, terminal or helper keeps a provider a storage read created.
+  // A Main conversation, terminal or helper keeps a provider a borrower created.
   // Every exported way to reach a provider for real use claims it here.
   function claimTransient(providerKey = "") {
     const key = normalizeText(providerKey);
@@ -292,35 +356,67 @@ export function createCodexAppServerProviderOwner({
     return acquireSession(context, mainThreadId);
   }
 
-  // Native storage inventory and retirement borrow a session provider. A short
-  // idle after the last such use lets consecutive reads share one process; the
-  // release then stops it unless another provider still uses it.
-  async function withTransientSession(context, operation) {
+  // The last borrower's return starts a short idle, so consecutive borrowers
+  // share one process; the release then stops it unless it was claimed.
+  function useBorrowed(providerKey, release) {
+    clearTimeout(release.timer);
+    release.users += 1;
+    let returned = false;
+    return () => {
+      if (returned) return;
+      returned = true;
+      release.users -= 1;
+      if (release.users > 0 || transientReleases.get(providerKey) !== release || closing) return;
+      release.timer = setTimeout(() => {
+        if (transientReleases.get(providerKey) !== release || release.users > 0) return;
+        transientReleases.delete(providerKey);
+        if (closing) return;
+        stopCachedProvider(providerKey).catch(error => debugLog("appServerRuntime.transientRelease.error", {
+          error: debugError(error), providerKey
+        }));
+      }, transientIdleMs);
+      release.timer.unref?.();
+    };
+  }
+
+  // Reads, storage work and Temporary chats borrow a session provider instead
+  // of claiming it. `release()` returns the borrow. A provider a real user
+  // already holds (it exists unborrowed, or a managed Main thread uses it) is
+  // simply used and stays that user's.
+  async function borrowSession(context) {
     const providerKey = context.providerKey;
     let release = transientReleases.get(providerKey);
-    // An existing provider or a managed main thread already has a real user.
     if (!release && (records.has(providerKey) || context.runOwner?.runtimeLifecycle?.managedThreadId?.(providerKey))) {
-      return operation(await acquireSession(context));
+      return { provider: await acquireSession(context), release() {} };
     }
     if (!release) transientReleases.set(providerKey, release = { users: 0, timer: null });
-    clearTimeout(release.timer);
-    release.users += 1;
+    const returnBorrow = useBorrowed(providerKey, release);
+    try {
+      return { provider: await acquireSession(context), release: returnBorrow };
+    } catch (error) {
+      returnBorrow();
+      throw error;
+    }
+  }
+
+  async function withTransientSession(context, operation) {
+    const borrowed = await borrowSession(context);
     try {
-      return await operation(await acquireSession(context));
+      return await operation(borrowed.provider);
     } finally {
-      release.users -= 1;
-      if (release.users === 0 && transientReleases.get(providerKey) === release && !closing) {
-        release.timer = setTimeout(() => {
-          if (transientReleases.get(providerKey) !== release) return;
-          transientReleases.delete(providerKey);
-          if (closing) return;
-          stopCachedProvider(providerKey).catch(error => debugLog("appServerRuntime.transientRelease.error", {
-            error: debugError(error), providerKey
-          }));
-        }, transientIdleMs);
-        release.timer.unref?.();
-      }
+      borrowed.release();
+    }
+  }
+
+  // Native work running on a borrowed provider (a Temporary turn or goal)
+  // holds it until that work ends. A claimed or closed provider needs no hold.
+  function holdProvider(provider) {
+    for (const [providerKey, record] of records) {
+      if (record.provider !== provider) continue;
+      const release = transientReleases.get(providerKey);
+      return release ? useBorrowed(providerKey, release) : () => {};
     }
+    return () => {};
   }
 
   async function acquireSession(context, mainThreadId = "") {
@@ -382,6 +478,15 @@ export function createCodexAppServerProviderOwner({
     if (closeProvider) record.provider.close?.();
     records.delete(providerKey);
     if (!records.size) codexAppServerProviders.delete(api);
+    if (record.provider.stale) {
+      // Another stop (a session close or idle release) ended a stale runtime.
+      const runtimeKey = codexAppServerOwnedRuntimeKey(providerKey, record.providerOptions);
+      const stale = codexAppServerStaleRuntimes.get(runtimeKey);
+      if (stale && !stale.retiring && ![...providerRecords()].some(peer =>
+        codexAppServerOwnedRuntimeKey(peer.providerKey, peer.providerOptions) === runtimeKey)) {
+        codexAppServerStaleRuntimes.delete(runtimeKey);
+      }
+    }
   }
 
   async function stopOwnedRuntime(record = {}, {
@@ -717,7 +822,78 @@ export function createCodexAppServerProviderOwner({
     return { ok: failed.length === 0, failed, results, providerCount: results.length, stopped: results.reduce((sum, result) => sum + result.threadIds.length, 0) };
   }
 
+  // A runtime with a running turn keeps the credentials it started with until
+  // that turn ends. Its active goals are paused so it starts no further turn;
+  // retireStaleRuntime stops it once it is idle.
+  async function deferBusyRuntime(runtimeKey, peers) {
+    let running;
+    try {
+      running = await runningNativeThreads(peers);
+    } catch (error) {
+      // An unreadable runtime cannot show a running turn: it stops as before.
+      debugLog("appServerRuntime.staleInspection.error", { error: debugError(error), runtimeKey });
+      return null;
+    }
+    if (!running.length) return null;
+    const client = peers.find(record => record.provider.client?.isOpen?.()).provider.client;
+    const pausedGoals = [];
+    for (const threadId of running) {
+      try {
+        const { goal } = await nativeRequest(client, "thread/goal/get", { threadId });
+        if (goal?.status !== "active") continue;
+        const result = await nativeRequest(client, "thread/goal/set", { threadId, status: "paused" });
+        if (result?.goal?.status !== "paused") throw new Error("Codex did not confirm that the goal was paused.");
+        pausedGoals.push(threadId);
+      } catch (error) {
+        debugLog("appServerRuntime.staleGoalPause.error", { error: debugError(error), runtimeKey, threadId });
+      }
+    }
+    for (const peer of peers) peer.provider.markStale?.();
+    const stale = {
+      runtimeKey, threadIds: running, pausedGoals, retiring: null,
+      providerKeys: peers.map(peer => peer.providerKey)
+    };
+    codexAppServerStaleRuntimes.set(runtimeKey, stale);
+    return stale;
+  }
+
+  // Stops a stale runtime once no loaded thread is running, through the same
+  // verified stop an idle runtime gets at the account change.
+  function retireStaleRuntime(runtimeKey = "") {
+    const stale = codexAppServerStaleRuntimes.get(runtimeKey);
+    if (!stale) return Promise.resolve(null);
+    if (stale.retiring) return stale.retiring;
+    const retiring = withRuntimeLifecycle(runtimeKey, async () => {
+      const peers = [...providerRecords()].filter(record =>
+        codexAppServerOwnedRuntimeKey(record.providerKey, record.providerOptions) === runtimeKey);
+      const running = await runningNativeThreads(peers).catch(() => []);
+      // A Temporary turn or goal holding a borrowed provider also keeps it.
+      if (running.length || peers.some(peer => peer.scope.isHeld?.(peer.providerKey))) {
+        return { ...stale, busy: true, stopped: false };
+      }
+      const owned = codexAppServerOwnedRuntimes.get(runtimeKey);
+      const target = owned || peers[0];
+      let result = { stopped: false };
+      if (target) {
+        result = await (target.scope || api).stopOwnedRuntime({ ...target }, {
+          cached: true,
+          // A runtime its session no longer records keeps no exit proof.
+          preserveProcessExitProof: target.preserveProcessExitProof === true && !stale.superseded,
+          requireVerifiedExit: true
+        });
+      }
+      for (const peer of peers) peer.scope.closeProvider(peer.providerKey);
+      codexAppServerStaleRuntimes.delete(runtimeKey);
+      return { ...stale, ...result, busy: false };
+    }).finally(() => {
+      if (stale.retiring === retiring) stale.retiring = null;
+    });
+    stale.retiring = retiring;
+    return retiring;
+  }
+
   async function invalidateRuntimes({
+    deferBusy = false,
     includeOwned = false,
     requireVerifiedExit = false,
     stopOwnedRuntimes = false,
@@ -766,6 +942,28 @@ export function createCodexAppServerProviderOwner({
     targets.sort((left, right) => Number(Boolean(left.record)) - Number(Boolean(right.record)));
     const failed = [];
     const results = [];
+    const deferred = [];
+    if (deferBusy) {
+      const groups = new Map();
+      for (const target of targets) {
+        const runtimeKey = codexAppServerOwnedRuntimeKey(target.providerKey, target.providerOptions);
+        if (!groups.has(runtimeKey)) groups.set(runtimeKey, []);
+        groups.get(runtimeKey).push(target);
+      }
+      for (const [runtimeKey, peers] of groups) {
+        if (codexAppServerStaleRuntimes.has(runtimeKey)) {
+          deferred.push(codexAppServerStaleRuntimes.get(runtimeKey));
+        } else {
+          const stale = await withRuntimeLifecycle(runtimeKey, () => deferBusyRuntime(runtimeKey, peers));
+          if (!stale) continue;
+          deferred.push(stale);
+        }
+        for (const peer of peers) {
+          targets.splice(targets.indexOf(peer), 1);
+          results.push({ providerKey: peer.providerKey, deferred: true, stopped: false });
+        }
+      }
+    }
     for (const target of targets) {
       if (!target.resources?.invalidation) continue;
       const error = Object.assign(new Error("Codex's native runtime was invalidated."), {
@@ -847,9 +1045,11 @@ export function createCodexAppServerProviderOwner({
     }
     const stopped = results.filter((result) => result.stopped).length;
     return {
+      deferred: deferred.map(({ runtimeKey, providerKeys, threadIds, pausedGoals }) =>
+        ({ runtimeKey, providerKeys: [...providerKeys], threadIds: [...threadIds], pausedGoals: [...pausedGoals] })),
       failed,
       ok: failed.length === 0,
-      providerCount: targets.length,
+      providerCount: targets.length + deferred.reduce((sum, stale) => sum + stale.providerKeys.length, 0),
       results,
       stopped
     };
@@ -924,7 +1124,7 @@ export function createCodexAppServerProviderOwner({
     preserveProcessExitProof = false,
     projectContextRoot = "",
     reason = "",
-  } = {}, { managed, keyFields, helperThreads }) {
+  } = {}, { managed, keyFields, helperThreads, sessionKeyPrefix = "" }) {
     const normalizedProjectContextRoot = normalizeText(projectContextRoot);
     if (!normalizedProjectContextRoot) {
       return {
@@ -942,11 +1142,14 @@ export function createCodexAppServerProviderOwner({
         projectContextRoot: normalizedProjectContextRoot
       }).map((record) => record.provider)
     );
+    // Main threads name their project; every other provider of the project's
+    // sessions (Temporary chats, reads) is found by its session key.
     const providerKeys = [...providers.keys()]
       .filter((providerKey) => {
         const current = managed.get(providerKey);
         return normalizeText(current?.projectContext?.targetRoot) === normalizedProjectContextRoot ||
-          helperProviders.has(providers.get(providerKey));
+          helperProviders.has(providers.get(providerKey)) ||
+          Boolean(sessionKeyPrefix && normalizeText(providerOwners.get(providerKey)?.sessionKey).startsWith(sessionKeyPrefix));
       });
     const failed = [];
     const results = [];
@@ -1205,7 +1408,8 @@ export function createCodexAppServerProviderOwner({
     return { exitFailure };
   }
 
-  // A provider a storage read borrowed is not the session's conversation.
+  // A borrowed provider (a read, storage work or a Temporary chat) is not the
+  // session's conversation.
   async function readPlanUsage(sessionKey) {
     for (const [key, provider] of providers) {
       if (providerOwners.get(key)?.sessionKey === sessionKey && !transientReleases.has(key) &&
@@ -1230,13 +1434,14 @@ export function createCodexAppServerProviderOwner({
 
   const api = Object.freeze({
     providers, providerOwners, ownedRuntimes, lifecycleTasks, runtimeAcquisitions,
+    isHeld: providerKey => (transientReleases.get(normalizeText(providerKey))?.users || 0) > 0,
     withLifecycle, runtimeIsShared, rememberOwnedRuntime, forgetOwnedRuntime, attachRuntimeLifecycle,
     acquireRuntime: options => { claimTransient(options?.providerKey); return acquireRuntime(options); },
     createProvider: options => { claimTransient(options?.providerKey); return createProvider(options); },
     providerForSession: context => { claimTransient(context.providerKey); return providerForSession(context); },
-    createNativeProvider, ensureSession, withTransientSession, retireAndCloseProvider, closeProvider, stopOwnedRuntime, stopCachedProvider, stopProvider, stopThreadBeforeRelease, readModelCatalog, invalidateRuntimes, recover,
+    createNativeProvider, ensureSession, borrowSession, withTransientSession, holdProvider, retireAndCloseProvider, closeProvider, stopOwnedRuntime, stopCachedProvider, stopProvider, stopThreadBeforeRelease, readModelCatalog, invalidateRuntimes, recover,
     reportRecoveryEvent, pendingRecovery, readSessionGoal, readPlanUsage, stopCachedProvidersForSession, stopProvidersForProject, drainThreadEnvironmentTasks, stopPersistedRuntime, sessionExitProof,
-    unsubscribeSessionThread, releasePersistedRuntimeProof, releasePreparedRuntimeProof, releaseSession,
+    unsubscribeSessionThread, releasePersistedRuntimeProof, releasePreparedRuntimeProof, releaseSession, retireStaleRuntime,
     beginShutdown() {
       closing = true;
       for (const release of transientReleases.values()) clearTimeout(release.timer);

package/src/server/conversation/codexProviderSelection.js

@@ -25,6 +25,11 @@ export function createCodexProviderSelection({
     return providerSessions.owner.ensureSession(sessionConnection(sessionId, providerOptions), threadId);
   }
 
+  // `{ provider, release }`: a use that does not keep the provider running.
+  function borrowSessionProvider(sessionId, providerOptions) {
+    return providerSessions.owner.borrowSession(sessionConnection(sessionId, providerOptions));
+  }
+
   function rememberManagedSession(sessionId, providerOptions, { executionRoot, workdir, threadId } = {}) {
     const connection = sessionConnection(sessionId, providerOptions);
     connection.runOwner.runtimeLifecycle.rememberManagedSession(connection.providerKey, {
@@ -36,14 +41,18 @@ export function createCodexProviderSelection({
     });
   }
 
-  function managedProviderKeyForThread(sessionId, workdir, threadId) {
+  // A provider left on the previous account (stale) serves only the turn it
+  // is still running: its output, steer and interrupt. Anything else goes to
+  // the session's provider for the current account.
+  function managedProviderKeyForThread(sessionId, workdir, threadId, { turnActive = false } = {}) {
     for (const [providerKey, managed] of providerSessions.managed) {
       const provider = providerSessions.owner.providers.get(providerKey);
       if (
         managed.sessionId !== sessionId ||
         managed.workdir !== workdir ||
         managed.threadId !== threadId ||
-        provider?.isAvailable?.() !== true
+        provider?.isAvailable?.() !== true ||
+        provider.stale && !turnActive
       ) {
         continue;
       }
@@ -72,7 +81,7 @@ export function createCodexProviderSelection({
         continue;
       }
       const provider = providerSessions.owner.providers.get(providerKey);
-      if (provider) {
+      if (provider && !(provider.stale && !turn.active)) {
         return {
           provider: await ensureSessionProvider(normalizedSessionId, managed.providerOptions),
           providerKey,
@@ -214,6 +223,7 @@ export function createCodexProviderSelection({
     codexAppServerSessionObserverOptions,
     sessionConnection,
     ensureSessionProvider,
+    borrowSessionProvider,
     rememberManagedSession
   };
 }

package/src/server/conversation/codexRuntimeLifecycle.js

@@ -12,6 +12,7 @@ export function createCodexRuntimeLifecycle({
   helperLifecycle,
   captureContext,
   runInContext,
+  continueGoalAfterAccountChange = null,
   debugLog,
   debugError,
   closingError = null
@@ -19,6 +20,7 @@ export function createCodexRuntimeLifecycle({
   const codexAppServerSessionClosures = new Map();
   const codexAppServerWellbeingTimers = new Map();
   const codexAppServerReconcileTasks = new Set();
+  const staleWatches = new Set();
   let codexAppServerThreadReconcileGeneration = 0;
   let codexAppServerServerClosing = false;
   let codexAppServerShutdownPromise = null;
@@ -78,9 +80,58 @@ export function createCodexRuntimeLifecycle({
     };
   }
 
+  // A runtime the account change left running a turn stops after that turn
+  // ends, once its output is recorded. A goal it paused then resumes, on the
+  // session's runtime for the current account.
+  function retireWhenIdle(stale) {
+    if (staleWatches.has(stale.runtimeKey)) return;
+    staleWatches.add(stale.runtimeKey);
+    const goals = new Map();
+    for (const providerKey of stale.providerKeys) {
+      const managed = providerSessions.managed.get(providerKey);
+      if (managed && stale.pausedGoals.includes(managed.threadId)) goals.set(managed.threadId, managed);
+    }
+    const unsubscribes = [];
+    let done = false;
+    const attempt = async () => {
+      if (done || codexAppServerServerClosing) return;
+      await Promise.allSettled([...pendingWork.notificationTasks.values(), ...pendingWork.resultFinalizations.values()]);
+      const retired = await providerSessions.owner.retireStaleRuntime(stale.runtimeKey);
+      if (retired?.busy || done) return;
+      done = true;
+      staleWatches.delete(stale.runtimeKey);
+      for (const unsubscribe of unsubscribes) unsubscribe();
+      debugLog("appServerRuntime.stale.retired", { runtimeKey: stale.runtimeKey, stopped: retired?.stopped === true });
+      if (!continueGoalAfterAccountChange || codexAppServerServerClosing) return;
+      for (const [threadId, managed] of goals) {
+        try {
+          await runInContext(managed.projectContext, () => continueGoalAfterAccountChange(managed.sessionId, { threadId }));
+        } catch (error) {
+          debugLog("appServerRuntime.stale.goalContinue.error", { error: debugError(error), sessionId: managed.sessionId, threadId });
+        }
+      }
+    };
+    const retire = () => attempt().catch(error => debugLog("appServerRuntime.stale.retire.error", {
+      error: debugError(error), runtimeKey: stale.runtimeKey
+    }));
+    for (const providerKey of stale.providerKeys) {
+      const provider = providerSessions.owner.providers.get(providerKey);
+      if (!provider?.subscribe) continue;
+      // Subscribed after the session observer, so its completion work for
+      // this notification is already queued when the retirement drains it.
+      unsubscribes.push(provider.subscribe(notification => {
+        if (notification?.method === "turn/completed") void retire();
+      }));
+    }
+    // The turn may have ended while the account change looked at it.
+    void retire();
+  }
+
   async function invalidateCodexAppServerRuntimes(input = {}) {
     const result = await providerSessions.owner.invalidateRuntimes(input);
+    for (const stale of result.deferred || []) retireWhenIdle(stale);
     debugLog("appServerRuntime.invalidate.done", {
+      deferredCount: (result.deferred || []).length,
       failedCount: result.failed.length,
       providerCount: result.providerCount,
       reason: normalizeText(input.reason),
@@ -257,17 +308,18 @@ export function createCodexRuntimeLifecycle({
         return shutdownCodexAppServerRuntimes(input);
       }
       if (input.includeOwned === true) {
+        // An account change stops idle runtimes now and busy ones when their
+        // turn ends; it never stops or waits for a running turn.
         return invalidateCodexAppServerRuntimes({
           ...input,
+          deferBusy: true,
           includeOwned: true,
           requireVerifiedExit: true,
           stopOwnedRuntimes: true
         });
       }
-      const helpers = await preparation.helpers;
-      helperLifecycle.assertRestored(
-        await helperLifecycle.restoreThreads(helpers.projectRuntimeRoot, helpers.context)
-      );
+      // Saved Helper threads are not reopened to be stopped: their records stay
+      // for the next connection, which retires them against the new account.
       return invalidateCodexAppServerRuntimes({
         ...input,
         includeOwned: false,

package/src/server/conversation/codexSessionCleanup.js

@@ -9,6 +9,27 @@ export function createCodexSessionCleanup({ namespace, runOwner, providerSession
   const providerOwner = providerSessions?.owner;
   const restrictedClosures = new WeakSet();
 
+  // Saved Helper records are retired through the providers a close is about to
+  // stop. A record that cannot be restored (a removed account, a malformed or
+  // unreadable ledger) stays on disk for a later connection; the host publishes
+  // its failure, and the close still stops everything this server runs.
+  async function restoreSavedHelpers(readRestoration, event, identity = {}) {
+    let restored;
+    try {
+      const restoration = await readRestoration();
+      restored = await helperLifecycle.restoreThreads(restoration.projectRuntimeRoot, restoration.context);
+    } catch (error) {
+      restored = { failed: [helperLifecycle.failure(identity, error)], ok: false };
+    }
+    if (restored.ok === false) {
+      debugLog(event, {
+        ...identity,
+        failed: restored.failed.map(({ code, error, sessionId, threadId }) => ({ code, error, sessionId, threadId }))
+      });
+    }
+    return restored;
+  }
+
   async function closeSession(sessionId, cleanup) {
     const normalizedSessionId = normalizeCodexRunText(sessionId);
     const sessionKey = cleanup.sessionKey;
@@ -28,27 +49,35 @@ export function createCodexSessionCleanup({ namespace, runOwner, providerSession
     const closing = (async () => {
       await providerOwner.drainThreadEnvironmentTasks(sessionKey);
       journal.clearSessionRecoveryTimers(normalizedSessionId);
+      const prepareFailed = (error) => {
+        debugLog("appServerRuntime.closeSession.prepare.error", {
+          error: debugError(error),
+          sessionId: normalizedSessionId
+        });
+        return error;
+      };
       let prepared = null;
       let session = null;
       try {
         prepared = await cleanup.read();
-        const restoration = await prepared.helpers;
-        helperLifecycle.assertRestored(await helperLifecycle.restoreThreads(
-          restoration.projectRuntimeRoot, restoration.context
-        ));
+        session = prepared.session;
+      } catch (error) {
+        throw prepareFailed(error);
+      }
+      // Live work stops first, through the connections that observe it.
+      await conversations.closeCodexAppServerConversations(normalizedSessionId);
+      await restoreSavedHelpers(() => prepared.helpers, "appServerRuntime.closeSession.helperRestore.failed", {
+        sessionId: normalizedSessionId
+      });
+      try {
+        // Helper threads attached to a live provider must be gone before it stops.
         helperLifecycle.assertRetired(await helperLifecycle.retireAll({
           projectRuntimeRoot: prepared.projectRuntimeRoot,
           sessionId: normalizedSessionId
         }));
-        session = prepared.session;
       } catch (error) {
-        debugLog("appServerRuntime.closeSession.prepare.error", {
-          error: debugError(error),
-          sessionId: normalizedSessionId
-        });
-        throw error;
+        throw prepareFailed(error);
       }
-      await conversations.closeCodexAppServerConversations(normalizedSessionId);
       const { exitFailure } = await providerOwner.releaseSession(sessionKey, {
         sessionId: normalizedSessionId,
         runOwner,
@@ -73,24 +102,42 @@ export function createCodexSessionCleanup({ namespace, runOwner, providerSession
   }
 
   async function closeProject(input = {}, preparation) {
-    const restoration = await preparation.helpers;
-    helperLifecycle.assertRestored(await helperLifecycle.restoreThreads(
-      restoration.projectRuntimeRoot, restoration.context
-    ));
     const sessionNamespacePrefix = namespace("");
+    const conversationFailures = [];
     for (const sessionKey of [...conversations.codexAppServerConversations.keys()]) {
       if (!sessionKey.startsWith(sessionNamespacePrefix)) {
         continue;
       }
-      await conversations.closeCodexAppServerConversations(
-        sessionKey.slice(sessionNamespacePrefix.length)
-      );
+      const sessionId = sessionKey.slice(sessionNamespacePrefix.length);
+      try {
+        await conversations.closeCodexAppServerConversations(sessionId);
+      } catch (error) {
+        conversationFailures.push({
+          code: normalizeCodexRunText(error?.code),
+          error: normalizeCodexRunText(error?.message || error),
+          retryable: error?.retryable !== false,
+          sessionId
+        });
+      }
     }
-    return providerOwner.stopProvidersForProject(input, {
+    const helperRestore = await restoreSavedHelpers(() => preparation.helpers,
+      "appServerRuntime.closeProject.helperRestore.failed",
+      { projectContextRoot: normalizeCodexRunText(input.projectContextRoot) });
+    // Every provider of the project's sessions stops, including one a
+    // Temporary chat or a read borrowed and no Main thread names.
+    const stopped = await providerOwner.stopProvidersForProject(input, {
       managed: providerSessions.managed,
       keyFields: providerSessions.keyFields,
-      helperThreads: helperLifecycle
+      helperThreads: helperLifecycle,
+      sessionKeyPrefix: sessionNamespacePrefix
     });
+    const failed = [...conversationFailures, ...stopped.failed];
+    return {
+      ...stopped,
+      failed,
+      helperRestore: { failed: helperRestore.failed, ok: helperRestore.ok !== false },
+      ok: failed.length === 0
+    };
   }
 
   return { closeSession, closeProject };