@runuai/host 0.8.35 → 0.8.37

package/db/migrations/0010_host_engine_accounts.sql

@@ -0,0 +1,13 @@
+-- ADR-076: multiple accounts per engine. One row per EXTRA (non-default)
+-- credential for an engine kind; the legacy single slot is synthesized as the
+-- "default" account and is NOT stored here. Secret material is sealed with the
+-- host master key (env kind) or lives in an isolated host dir (config-dir kind).
+CREATE TABLE `host_engine_accounts` (
+	`id` text PRIMARY KEY NOT NULL,
+	`kind` text NOT NULL,
+	`label` text NOT NULL,
+	`auth_kind` text NOT NULL,
+	`secret_enc` text,
+	`config_dir` text,
+	`created_at` integer NOT NULL
+);

package/db/migrations/meta/_journal.json

@@ -71,6 +71,13 @@
       "when": 1779900010000,
       "tag": "0009_host_agent_sessions",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "6",
+      "when": 1779900011000,
+      "tag": "0010_host_engine_accounts",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -176,3 +176,27 @@ export const mcpConnections = sqliteTable("host_mcp_connections", {
 });
 
 export type McpConnection = typeof mcpConnections.$inferSelect;
+
+// Extra (non-default) engine accounts (ADR-076). One row per additional
+// credential for an engine kind, beyond the single legacy slot (.env.local /
+// ~/.codex / ~/.local/share/opencode) which is synthesized as the "default"
+// account and NOT stored here. Secret material is sealed with the host master
+// key (same secret-blind pattern as host_github_tokens — ADR-015):
+//   - authKind "env":        secretEnc = sealed JSON of env vars, e.g.
+//                            {"CLAUDE_CODE_OAUTH_TOKEN":"sk-ant-oat…"}.
+//   - authKind "config-dir": configDir = the host dir holding this account's
+//                            auth files (an isolated ~/.codex-acct-<id> etc.);
+//                            secretEnc is null (the dir IS the secret at rest).
+// Rotation state (cooldown / last-used) is in-memory only, not persisted.
+export const engineAccounts = sqliteTable("host_engine_accounts", {
+  id: text("id").primaryKey(), // ulid
+  kind: text("kind").notNull(), // "claude" | "codex" | "opencode" | …
+  label: text("label").notNull(), // display, e.g. "work"
+  authKind: text("auth_kind").notNull(), // "env" | "config-dir"
+  secretEnc: text("secret_enc"), // sealed JSON (env kind); null for config-dir
+  configDir: text("config_dir"), // host dir (config-dir kind); null for env
+  createdAt: integer("created_at", { mode: "number" }).notNull(),
+});
+
+export type EngineAccountRow = typeof engineAccounts.$inferSelect;
+export type NewEngineAccountRow = typeof engineAccounts.$inferInsert;

package/images/standard/Dockerfile

@@ -246,6 +246,15 @@ RUN if [ "$INSTALL_CURSOR" = "1" ]; then \
         || echo "[warn] cursor install failed — cursor engine unavailable in this image"; \
     fi
 
+# OpenCode (ADR-077) — multi-provider CLI. Installs to /home/node/.opencode/bin;
+# the adapter invokes it by absolute path and task-up copies the provider auth
+# (~/.local/share/opencode/auth.json) in. Non-fatal like the others.
+ARG INSTALL_OPENCODE=0
+RUN if [ "$INSTALL_OPENCODE" = "1" ]; then \
+      bash -lc 'curl -fsSL https://opencode.ai/install | bash' \
+        || echo "[warn] opencode install failed — opencode engine unavailable in this image"; \
+    fi
+
 ENV PATH=/home/node/.local/bin:$PATH
 
 # ---------------------------------------------------------------------------

package/lib/agents/claude.ts

@@ -22,6 +22,7 @@
 
 import { newId } from "../ulid";
 import { createAgentTransport, type LineTransport } from "./transport";
+import { isRateLimitMessage } from "./rate-limit";
 import { register } from "./registry";
 import { extractResultUsage } from "./usage";
 import type {
@@ -123,8 +124,13 @@ export function mapClaudeLine(raw: string): AgentEvent[] {
     const usage = extractResultUsage(json);
     if (json.is_error === true) {
       // An errored turn still cost tokens — meter it.
+      const message = text || "claude returned an error";
       return [
-        { type: "error", message: text || "claude returned an error" },
+        // ADR-076: a rate-limit/usage-cap error is failed over to another
+        // account by the orchestrator rather than surfaced to the user.
+        isRateLimitMessage(message)
+          ? { type: "error", message, retryable: "rate_limit" }
+          : { type: "error", message },
         { type: "turn_complete", usage },
       ];
     }

package/lib/agents/codex.ts

@@ -34,6 +34,7 @@ import { join } from "node:path";
 
 import { newId } from "../ulid";
 import { createAgentTransport, type LineTransport } from "./transport";
+import { isRateLimitMessage } from "./rate-limit";
 import { register } from "./registry";
 import type {
   AgentEvent,
@@ -134,8 +135,11 @@ export function mapCodexNotification(
   if (method === "turn/completed") {
     const turn = isObj(p.turn) ? p.turn : {};
     if (turn.status === "failed" && isObj(turn.error)) {
+      const message = str(turn.error.message, "codex turn failed");
       return [
-        { type: "error", message: str(turn.error.message, "codex turn failed") },
+        isRateLimitMessage(message)
+          ? { type: "error", message, retryable: "rate_limit" }
+          : { type: "error", message },
         { type: "turn_complete" },
       ];
     }
@@ -146,7 +150,9 @@ export function mapCodexNotification(
     const message = isObj(p.error)
       ? str(p.error.message, "codex error")
       : "codex error";
-    return [{ type: "error", message }];
+    return isRateLimitMessage(message)
+      ? [{ type: "error", message, retryable: "rate_limit" }]
+      : [{ type: "error", message }];
   }
 
   return [];

package/lib/agents/factory.ts

@@ -20,6 +20,7 @@ import "./codex";
 import "./kimi";
 import "./grok";
 import "./cursor";
+import "./opencode";
 
 import { agentClisReady } from "../standard-image";
 import { factoryFor } from "./registry";

package/lib/agents/opencode.ts

@@ -0,0 +1,461 @@
+/**
+ * OpencodeSession — a real AgentSession backed by the OpenCode CLI's
+ * non-interactive `run` mode, executed inside the task container (ADR-077):
+ *
+ *   docker exec -i task-<id>-app-1 ~/.opencode/bin/opencode run \
+ *     --format json --auto --model <provider/model> [--variant <effort>] \
+ *     [--session <id>] "<prompt>"
+ *
+ * Like Kimi/Grok/Cursor (ADR-066/067/068) OpenCode is **one-shot per turn**:
+ * `run` executes a single prompt to completion, streams newline-delimited JSON
+ * events to stdout, and exits. Multi-turn continuity is `--session <id>` (the
+ * id is captured from the first turn's event stream). Each `send()` spawns a
+ * fresh `docker exec`; sends are serialized so a second message can't race a
+ * running turn.
+ *
+ * `--format json` vocabulary (one object per line, `type` field):
+ *   {"type":"step_start", ...}                        → (ignored)
+ *   {"type":"text","part":{"text":"…"}}               → message_complete
+ *   {"type":"tool_use","part":{"tool","state":{…}}}   → tool_call
+ *   {"type":"step_finish","part":{"cost","tokens":…}} → (accumulated usage)
+ *   {"type":"error","error":{…}}                      → error
+ * Every event carries a top-level `sessionID` (captured for --session). The
+ * turn ends when the process exits (turn_complete, with accumulated usage).
+ *
+ * AUTH is the operator's OpenCode provider keys in
+ * `~/.local/share/opencode/auth.json`, docker-cp'd into the container at
+ * task-up (like Codex's ~/.codex) — never the cloud (ADR-015). `--auto`
+ * auto-approves tool permissions (the container is the isolation boundary), so
+ * there are no permission prompts to resolve. ADR-076: `OPENCODE_DATA_DIR` in
+ * agentEnv selects which account's data dir (auth) this exec uses.
+ */
+import { spawn, type ChildProcess } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import { newId } from "../ulid";
+import { isRateLimitMessage } from "./rate-limit";
+import { register } from "./registry";
+import type {
+  AgentEvent,
+  AgentEventHandler,
+  AgentKind,
+  AgentSession,
+  AgentUsage,
+  RosterAgent,
+} from "./types";
+
+/** Installed by the image's opencode installer (opencode.ai/install); absolute
+ *  so a non-login `docker exec` doesn't depend on PATH. */
+const OPENCODE_BIN = "/home/node/.opencode/bin/opencode";
+
+// OpenCode is multi-provider: models are `provider/model` strings. This is a
+// curated slice keyed to OpenCode Zen (the `opencode/…` gateway that the
+// connect picker defaults to — OpenCode's own coding-benchmarked catalog);
+// any provider/model the operator's auth.json can drive is still typable in
+// the composer (unlisted values round-trip). If you bring native provider
+// keys instead of Zen, type e.g. `anthropic/claude-sonnet-5` directly.
+// UPDATE alongside lib/agent-catalog.ts. Order = display order. Deprecated Zen
+// models are intentionally omitted (they 4xx): the gpt-5.x-codex/gpt-5-codex
+// line (retired 2026-07-23), glm-5, minimax-m2.5, kimi-k2.5.
+const OPENCODE_MODELS = [
+  // Anthropic (Claude).
+  "opencode/claude-sonnet-5",
+  "opencode/claude-opus-5",
+  "opencode/claude-opus-4-8",
+  "opencode/claude-opus-4-7",
+  "opencode/claude-opus-4-6",
+  "opencode/claude-opus-4-5",
+  "opencode/claude-sonnet-4-6",
+  "opencode/claude-sonnet-4-5",
+  "opencode/claude-haiku-4-5",
+  "opencode/claude-fable-5",
+  // OpenAI (GPT).
+  "opencode/gpt-5.6-sol",
+  "opencode/gpt-5.6-terra",
+  "opencode/gpt-5.6-luna",
+  "opencode/gpt-5.5",
+  "opencode/gpt-5.5-pro",
+  "opencode/gpt-5.4",
+  "opencode/gpt-5.4-pro",
+  "opencode/gpt-5.4-mini",
+  "opencode/gpt-5.4-nano",
+  "opencode/gpt-5.3-codex",
+  "opencode/gpt-5.3-codex-spark",
+  "opencode/gpt-5.2",
+  "opencode/gpt-5.1",
+  "opencode/gpt-5",
+  "opencode/gpt-5-nano",
+  // Google (Gemini).
+  "opencode/gemini-3.6-flash",
+  "opencode/gemini-3.5-flash",
+  "opencode/gemini-3.5-flash-lite",
+  "opencode/gemini-3.1-pro",
+  "opencode/gemini-3-flash",
+  // xAI (Grok).
+  "opencode/grok-4.5",
+  "opencode/grok-build-0.1",
+  // Open-weight — Moonshot Kimi.
+  "opencode/kimi-k2.7-code",
+  "opencode/kimi-k2.6",
+  // Open-weight — Alibaba Qwen.
+  "opencode/qwen3.7-max",
+  "opencode/qwen3.7-plus",
+  "opencode/qwen3.6-plus",
+  "opencode/qwen3.5-plus",
+  // Open-weight — DeepSeek.
+  "opencode/deepseek-v4-pro",
+  "opencode/deepseek-v4-flash",
+  // Open-weight — Z.ai GLM.
+  "opencode/glm-5.2",
+  "opencode/glm-5.1",
+  // Open-weight — MiniMax.
+  "opencode/minimax-m3",
+  "opencode/minimax-m2.7",
+  // Free / stealth (time-limited; some retain data during their free window).
+  "opencode/big-pickle",
+  "opencode/deepseek-v4-flash-free",
+  "opencode/mimo-v2.5-free",
+  "opencode/laguna-s-2.1-free",
+  "opencode/ling-3.0-flash-free",
+  "opencode/north-mini-code-free",
+  "opencode/nemotron-3-ultra-free",
+];
+const OPENCODE_DEFAULT_MODEL = "opencode/claude-sonnet-5";
+
+// Reasoning effort is a provider-specific `--variant`, not a fixed list, so the
+// picker offers none; a typed effort is still passed through.
+const OPENCODE_EFFORTS: string[] = [];
+
+/** Host path to the operator's OpenCode auth — its presence gates the engine
+ *  (mirrors Codex's ~/.codex/auth.json check). */
+function opencodeAuthPath(): string {
+  return join(
+    process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    ".local",
+    "share",
+    "opencode",
+    "auth.json",
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Pure protocol mapping — one JSON line → AgentEvent[] (+ session id / usage).
+// ---------------------------------------------------------------------------
+
+function isObj(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null;
+}
+
+function str(v: unknown, fallback = ""): string {
+  return typeof v === "string" ? v : fallback;
+}
+
+function num(v: unknown): number | undefined {
+  return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+
+export interface MappedOpencodeLine {
+  events: AgentEvent[];
+  /** The session id, when this line carried one (for --session continuity). */
+  sessionId?: string;
+  /** Usage accounting, when this line was a step_finish. */
+  usage?: AgentUsage;
+}
+
+/** Best-effort one-line detail for a tool card from a tool_use part. */
+function toolDetail(state: unknown): string {
+  if (!isObj(state)) return "";
+  const title = state.title;
+  if (typeof title === "string" && title.length > 0) return title;
+  const input = state.input;
+  if (typeof input === "string") return input;
+  try {
+    return input !== undefined ? JSON.stringify(input) : "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Map a single OpenCode `run --format json` line. Non-JSON lines and events
+ * with no user-facing meaning (step_start) map to no events. Total + pure.
+ */
+export function mapOpencodeLine(line: string): MappedOpencodeLine {
+  const trimmed = line.trim();
+  if (!trimmed.startsWith("{")) return { events: [] };
+  let msg: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(trimmed);
+    if (!isObj(parsed)) return { events: [] };
+    msg = parsed;
+  } catch {
+    return { events: [] };
+  }
+
+  const sessionId =
+    typeof msg.sessionID === "string" ? msg.sessionID : undefined;
+  const type = str(msg.type);
+  const part = isObj(msg.part) ? msg.part : {};
+
+  if (type === "text") {
+    const text = str(part.text);
+    return text
+      ? { events: [{ type: "message_complete", text }], sessionId }
+      : { events: [], sessionId };
+  }
+
+  if (type === "tool_use") {
+    const state = isObj(part.state) ? part.state : {};
+    return {
+      events: [
+        {
+          type: "tool_call",
+          id: str(part.callID) || str(part.id) || newId(),
+          title: str(part.tool, "tool"),
+          detail: toolDetail(state),
+        },
+      ],
+      sessionId,
+    };
+  }
+
+  if (type === "step_finish") {
+    const tokens = isObj(part.tokens) ? part.tokens : {};
+    const cache = isObj(tokens.cache) ? tokens.cache : {};
+    const usage: AgentUsage = {
+      inputTokens: num(tokens.input),
+      outputTokens: num(tokens.output),
+      cacheReadTokens: num(cache.read),
+      cacheCreateTokens: num(cache.write),
+      costUsd: num(part.cost),
+    };
+    return { events: [], sessionId, usage };
+  }
+
+  if (type === "error") {
+    const err = isObj(msg.error) ? msg.error : {};
+    const data = isObj(err.data) ? err.data : {};
+    const message =
+      str(data.message) || str(err.name) || "opencode error";
+    return {
+      events: [
+        isRateLimitMessage(message)
+          ? { type: "error", message, retryable: "rate_limit" }
+          : { type: "error", message },
+      ],
+      sessionId,
+    };
+  }
+
+  return { events: [], sessionId };
+}
+
+// ---------------------------------------------------------------------------
+// Session
+// ---------------------------------------------------------------------------
+
+/** Injectable spawn seam (tests provide a fake). */
+export type Spawner = (args: string[]) => ChildProcess;
+const defaultSpawn: Spawner = (args) =>
+  spawn("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+
+/** Sum this turn's step usage into a running total. */
+function addUsage(acc: AgentUsage, u: AgentUsage): AgentUsage {
+  const add = (a?: number, b?: number): number | undefined =>
+    a === undefined && b === undefined ? undefined : (a ?? 0) + (b ?? 0);
+  return {
+    inputTokens: add(acc.inputTokens, u.inputTokens),
+    outputTokens: add(acc.outputTokens, u.outputTokens),
+    cacheReadTokens: add(acc.cacheReadTokens, u.cacheReadTokens),
+    cacheCreateTokens: add(acc.cacheCreateTokens, u.cacheCreateTokens),
+    costUsd: add(acc.costUsd, u.costUsd),
+  };
+}
+
+export class OpencodeSession implements AgentSession {
+  readonly agentId: string;
+  readonly kind: AgentKind = "opencode";
+
+  private readonly containerName: string;
+  private readonly model?: string;
+  private readonly effort?: string;
+  private readonly systemPreamble: string;
+  private readonly agentEnv: Record<string, string>;
+  private readonly spawner: Spawner;
+
+  private readonly handlers = new Set<AgentEventHandler>();
+  private sessionId: string | null = null;
+  private current: ChildProcess | null = null;
+  private queue: Promise<void> = Promise.resolve();
+  private sentPreamble = false;
+  private closed = false;
+
+  constructor(args: {
+    taskId: string;
+    agent: RosterAgent;
+    containerName: string;
+    systemPreamble: string;
+    agentEnv?: Record<string, string>;
+    spawner?: Spawner;
+  }) {
+    this.agentId = args.agent.id;
+    this.containerName = args.containerName;
+    this.model = args.agent.model;
+    this.effort = args.agent.effort;
+    this.systemPreamble = args.systemPreamble;
+    this.agentEnv = args.agentEnv ?? {};
+    this.spawner = args.spawner ?? defaultSpawn;
+  }
+
+  onEvent(handler: AgentEventHandler): () => void {
+    this.handlers.add(handler);
+    return () => this.handlers.delete(handler);
+  }
+
+  private emit(event: AgentEvent): void {
+    if (this.closed && event.type !== "exit") return;
+    for (const h of this.handlers) h(event);
+  }
+
+  /** One-shot per turn; serialize so a second message queues behind the
+   *  running one instead of spawning a racing `opencode run`. */
+  async send(text: string): Promise<void> {
+    if (this.closed) return;
+    this.queue = this.queue.then(() => this.runTurn(text));
+    return this.queue;
+  }
+
+  private buildArgs(prompt: string): string[] {
+    const args = ["exec", "-i", "-u", "node"];
+    for (const [k, v] of Object.entries(this.agentEnv)) {
+      args.push("-e", `${k}=${v}`);
+    }
+    args.push(
+      this.containerName,
+      OPENCODE_BIN,
+      "run",
+      "--format",
+      "json",
+      // Auto-approve permissions not explicitly denied — the container is the
+      // sandbox, and headless has no interactive approver.
+      "--auto",
+    );
+    if (this.model) args.push("--model", this.model);
+    if (this.effort) args.push("--variant", this.effort);
+    // Continue the same OpenCode session across turns (captured from the first
+    // turn's stream). First turn has none → a fresh session.
+    if (this.sessionId) args.push("--session", this.sessionId);
+    // The prompt is positional; put it LAST so it's never mistaken for a flag.
+    args.push(prompt);
+    return args;
+  }
+
+  private async runTurn(text: string): Promise<void> {
+    if (this.closed) return;
+    // `run` has no system-prompt flag, so fold the channel briefing into the
+    // FIRST turn's prompt (later turns carry it via the resumed session).
+    const prompt =
+      !this.sentPreamble && this.systemPreamble.trim().length > 0
+        ? `${this.systemPreamble}\n\n---\n\n${text}`
+        : text;
+    this.sentPreamble = true;
+
+    const child = this.spawner(this.buildArgs(prompt));
+    this.current = child;
+
+    let turnUsage: AgentUsage = {};
+    let sawUsage = false;
+    let buf = "";
+    const consume = (chunk: string): void => {
+      buf += chunk;
+      let nl: number;
+      while ((nl = buf.indexOf("\n")) >= 0) {
+        const line = buf.slice(0, nl);
+        buf = buf.slice(nl + 1);
+        const { events, sessionId, usage } = mapOpencodeLine(line);
+        if (sessionId) this.sessionId = sessionId;
+        if (usage) {
+          turnUsage = addUsage(turnUsage, usage);
+          sawUsage = true;
+        }
+        for (const e of events) this.emit(e);
+      }
+    };
+    child.stdout?.on("data", (b: Buffer) => consume(b.toString("utf8")));
+    let stderr = "";
+    child.stderr?.on("data", (b: Buffer) => {
+      stderr += b.toString("utf8");
+    });
+
+    await new Promise<void>((resolve) => {
+      child.on("exit", (code) => {
+        this.current = null;
+        if (buf.trim().length > 0) consume("\n"); // flush a trailing line
+        if (!this.closed) {
+          if (code !== 0) {
+            const tail = stderr.trim().slice(-500);
+            const message = `opencode exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`;
+            this.emit(
+              isRateLimitMessage(message)
+                ? { type: "error", message, retryable: "rate_limit" }
+                : { type: "error", message },
+            );
+          }
+          this.emit({
+            type: "turn_complete",
+            usage: sawUsage ? turnUsage : undefined,
+          });
+        }
+        resolve();
+      });
+      child.on("error", (err) => {
+        this.current = null;
+        if (!this.closed) {
+          this.emit({
+            type: "error",
+            message: `opencode spawn failed: ${err.message}`,
+          });
+          this.emit({ type: "turn_complete" });
+        }
+        resolve();
+      });
+    });
+  }
+
+  async interrupt(): Promise<void> {
+    // Kill the running turn's exec. Best-effort — the in-container `opencode`
+    // may finish the current tool, but no further output is emitted.
+    this.current?.kill("SIGKILL");
+  }
+
+  // `--auto` approves tools (the container is the sandbox), so no permission
+  // requests are ever emitted — nothing to resolve.
+  async resolvePermission(): Promise<void> {
+    /* no-op */
+  }
+
+  async close(): Promise<void> {
+    if (this.closed) return;
+    this.closed = true;
+    this.current?.kill("SIGKILL");
+    this.current = null;
+    this.emit({ type: "exit", code: 0 });
+    this.handlers.clear();
+  }
+}
+
+// Register the OpenCode adapter at module load (ADR-021/077).
+register({
+  kind: "opencode",
+  label: "OpenCode",
+  supportedModels: () => [...OPENCODE_MODELS],
+  defaultModel: OPENCODE_DEFAULT_MODEL,
+  supportedEfforts: () => [...OPENCODE_EFFORTS],
+  // Gated on the operator's OpenCode auth (copied into containers at task-up).
+  // No auth → the engine isn't advertised.
+  available: () => existsSync(opencodeAuthPath()),
+  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
+    new OpencodeSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+});

package/lib/agents/rate-limit.ts

@@ -0,0 +1,41 @@
+/**
+ * Rate-limit / quota classification for agent errors (ADR-076).
+ *
+ * When an engine reports an error that means "this account is temporarily out
+ * of capacity" (usage cap, 429, quota, overloaded), the orchestrator cools the
+ * current account and fails over to the next one. Each adapter's pure mapper
+ * runs the error text through {@link isRateLimitMessage} and tags the resulting
+ * `error` event with `retryable: "rate_limit"` so rotation can act on it
+ * without re-parsing engine-specific strings downstream.
+ *
+ * Deliberately broad but anchored on unambiguous tokens — a false positive
+ * only rotates to another account (cheap, self-correcting), a false negative
+ * just surfaces the error as today.
+ */
+const RATE_LIMIT_PATTERNS: RegExp[] = [
+  /rate[\s_-]?limit/i,
+  /\b429\b/,
+  /too many requests/i,
+  /quota/i,
+  /usage limit/i,
+  /usage cap/i,
+  // Claude subscription caps: "You've hit your weekly limit · resets …",
+  // "reached your 5-hour limit", "exceeded your limit". Anchored on
+  // hit/reached/exceeded so an "approaching your … limit" WARNING won't match
+  // (a warning isn't exhaustion — rotating on it would waste the account).
+  /(?:hit|reached|exceeded)\s+your\s+.{0,40}?\blimit\b/i,
+  /\blimit reached\b/i,
+  // A reset hint sitting next to "limit" ("limit · resets Jul 27") is a cap.
+  /\blimit\b[^.\n]{0,40}\bresets?\b/i,
+  /overloaded/i,
+  /capacity/i,
+  /resource[\s_-]?exhausted/i,
+  /insufficient_quota/i,
+  /billing (?:hard )?limit/i,
+];
+
+/** Whether an engine error message looks like a rate-limit / quota exhaustion. */
+export function isRateLimitMessage(message: string | undefined | null): boolean {
+  if (!message) return false;
+  return RATE_LIMIT_PATTERNS.some((re) => re.test(message));
+}

package/lib/agents/types.ts

@@ -114,8 +114,10 @@ export type AgentEvent =
   /** The turn (one request → response cycle) is done; agent is idle.
    *  `usage` carries this turn's token/cost accounting when the CLI reports it. */
   | { type: "turn_complete"; usage?: AgentUsage }
-  /** A recoverable error surfaced by the agent. */
-  | { type: "error"; message: string }
+  /** A recoverable error surfaced by the agent. `retryable` marks errors the
+   *  orchestrator can fail over from — "rate_limit" triggers account rotation
+   *  (ADR-076). */
+  | { type: "error"; message: string; retryable?: "rate_limit" }
   /** The underlying process exited. */
   | { type: "exit"; code: number };
 

package/lib/codex-auth.ts

@@ -40,6 +40,7 @@ import { isNull } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
 import { dockerCli } from "./docker-exec";
+import { provisionEngineAccounts } from "./engine-accounts";
 
 /** The exact set task-up.sh copies into `/home/node/.codex`. */
 const CODEX_ITEMS = [
@@ -197,6 +198,9 @@ export async function reinjectCodexRunningTasks(deps: CodexDeps = {}): Promise<v
         `[codex] reinject into ${container} failed: ${err instanceof Error ? err.message : err}`,
       );
     }
+    // ADR-076: also refresh EXTRA config-dir accounts (codex + opencode) so a
+    // newly-added second account reaches running tasks, same as the default.
+    await provisionEngineAccounts(container, ["codex", "opencode"]);
   }
 }