@songsid/agend 2.3.3-beta.1 → 2.3.3-beta.10

package/dist/backend/codex.js

@@ -14,6 +14,7 @@ import { codexEffort } from "./launch-effort.js";
 import { appendWithMarker, removeMarker } from "./marker-utils.js";
 import { codexSiblingState, codexStateDbAbsent, cwdRolloutsProvenAbsent, findExactCwdCodexSession, planCodexResume, newestMissedCwdRollout } from "./codex-session-lookup.js";
 import { t } from "../locale.js";
+import { quotaLine, quotaLowLine, quotaPausedLine } from "../quota-notice.js";
 import { parse as parseToml } from "smol-toml";
 const CODEX_PROJECT_DOC_MAX_BYTES = 32_768;
 const SAFE_MODEL_ID_RE = /^[A-Za-z0-9._:/-]+$/;
@@ -296,7 +297,7 @@ function setProjectTrusted(content, root) {
 }
 /** Only the bottom, live Codex 0.156 folder-access screen can own stdin. */
 function codexTrustPromptState(pane) {
-    const noPrompt = { active: false, folder: null, root: null, rootNote: "absent", safeChoice: false };
+    const noPrompt = { active: false, folder: null, root: null, rootNote: "absent", safeChoice: false, trustCursor: false };
     const rows = pane.replace(/\r/g, "").split("\n");
     let last = rows.length - 1;
     while (last >= 0 && rows[last].trim() === "")
@@ -343,7 +344,16 @@ function codexTrustPromptState(pane) {
         && choices[0].cursor === "›" && choices[0].number === "1" && choices[0].text === "Trust and continue"
         && choices[1].cursor === "" && choices[1].number === "2" && choices[1].text === "Quit"
         && /^\s*enter continue\s*·\s*esc quit\s*$/i.test(rows[last]);
-    return { active: true, folder, root, rootNote, safeChoice };
+    const known = new Set(["Trust and continue", "Open restricted", "Quit"]);
+    // Exactly one selection marker, whichever form (› ❯ >), and it is on Trust; the footer is the one both 0.160 and 0.166
+    // show. Two markers, another footer mapping or an unknown option is held — never a guess where Enter lands (#2896 review).
+    const atCursor = choices.filter(choice => choice.cursor !== "");
+    const trustCursor = choices.length >= 2 && choices.every(choice => known.has(choice.text))
+        && choices.every((choice, index) => index === 0 || choice.row === choices[index - 1].row + 1)
+        && rows.slice(choices[choices.length - 1].row + 1, last).every(row => row.trim() === "")
+        && atCursor.length === 1 && atCursor[0].cursor === "›" && atCursor[0].text === "Trust and continue"
+        && /^\s*enter continue\s*·\s*esc quit\s*$/i.test(rows[last]);
+    return { active: true, folder, root, rootNote, safeChoice, trustCursor };
 }
 /** Unknown/older trust layouts are still input-blocking, never auto-answered. */
 function codexTrustVariantActive(pane) {
@@ -538,6 +548,55 @@ function codexRateSwitchPickerVisible(pane) {
         && take(/^\s*Switch to \S.{0,120} for lower credit usage\?\s*$/, false)
         && take(/^\s*Approaching rate limits\s*$/, false);
 }
+/**
+ * The workspace-member limit prompt (#2844), as codex 0.160.0–0.165.0 paint it
+ * (`open_workspace_owner_nudge_prompt`, codex-rs/tui chatwidget/rate_limits.rs),
+ * captured live on 0.165.0 against the mock's wscredits/wsspend modes:
+ *
+ *   ■ Your workspace is out of credits. Ask your workspace owner to refill in order to continue.
+ *     Usage limit reached
+ *     Request a limit increase from your owner to continue using codex. Request increase?
+ *
+ *     1. Yes (y)
+ *   › 2. No (default) (n)
+ *
+ *     enter select · esc back
+ *
+ * The other title is "You've reached your workspace credit limit" with "…Ask your
+ * workspace owner to add more. Notify owner?". Yes emails the workspace owner;
+ * Escape (the prompt's cancel) and No only close it, send nothing, and leave the
+ * error row above the composer, where the quota pause reads it.
+ *
+ * Bottom-anchored, every row exact: the hint last, the two options directly
+ * above it, the question (wrapped onto up to three rows on a narrow pane) and its
+ * own title above those. A quote in the transcript is followed by the composer
+ * and never matches.
+ */
+const WORKSPACE_LIMIT_PROMPTS = [
+    [/^\s*Usage limit reached\s*$/, "Request a limit increase from your owner to continue using codex. Request increase?"],
+    [/^\s*You['’]ve reached your workspace credit limit\s*$/, "Your workspace is out of credits. Ask your workspace owner to add more. Notify owner?"],
+];
+function codexWorkspaceLimitPromptVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n").filter(row => row.trim() !== "");
+    let i = rows.length - 1;
+    const take = (shape) => {
+        if (i < 0 || !shape.test(rows[i]))
+            return false;
+        i--;
+        return true;
+    };
+    if (!(take(/^\s*enter select\s*[·•]\s*esc back\s*$/i)
+        && take(/^\s*[›❯>]?\s*2\.\s+No \(default\)\s+\(n\)\s*$/)
+        && take(/^\s*[›❯>]?\s*1\.\s+Yes\s+\(y\)\s*$/)))
+        return false;
+    for (let lines = 1; lines <= 3 && i - lines >= 0; lines++) {
+        const question = rows.slice(i - lines + 1, i + 1).map(row => row.trim()).join(" ");
+        const title = rows[i - lines];
+        if (WORKSPACE_LIMIT_PROMPTS.some(([shape, text]) => question === text && shape.test(title)))
+            return true;
+    }
+    return false;
+}
 /** Unknown pickers own stdin too; never type or press Enter into one. */
 function codexUnknownSelectionVisible(pane) {
     const rows = pane.replace(/\r/g, "").split("\n");
@@ -1169,9 +1228,11 @@ export class CodexBackend {
     buildCommand(config) {
         this.lastKnownModel = config.model?.trim() || null;
         this.credentialProfile = this.readProfile(config);
+        // #2886: `--full-auto` is gone from codex (no supported version, 0.155 on, accepts it: the instance never started);
+        // spelled out, it was a workspace-write sandbox that asks for approval on request.
         const approvalFlag = config.skipPermissions !== false
             ? "--dangerously-bypass-approvals-and-sandbox"
-            : "--full-auto";
+            : "--sandbox workspace-write --ask-for-approval on-request";
         // #984: never trust `codex resume --last` to pick this instance's session.
         // Codex 0.157 scopes it to the git REPOSITORY, so in a worktree it resumes
         // the newest session of any sibling worktree (a lock screen while that
@@ -1894,6 +1955,7 @@ export class CodexBackend {
                 type: "quota",
                 action: "pause",
                 message: "OpenAI quota exceeded",
+                notice: () => quotaPausedLine("OpenAI", "api_quota"),
             },
             {
                 // Codex already exhausted HTTP retries and returned to its composer.
@@ -1929,7 +1991,8 @@ export class CodexBackend {
             // Codex writes the apostrophe as U+2019 ("You’ve hit your usage limit.") since
             // 0.156 and as ASCII before (0.153.4): both must match, or no usage limit
             // ever pauses the instance (#1098).
-            { pattern: /you['’]ve hit your usage limit/i, type: "quota", action: "pause", message: "Codex usage limit reached — upgrade plan required" },
+            { pattern: /you['’]ve hit your usage limit/i, type: "quota", action: "pause", message: "Codex usage limit reached — upgrade plan required",
+                notice: () => quotaPausedLine("Codex", "usage") },
             {
                 // The terminal stage of a lost app-server (#1099): Codex has given up
                 // reconnecting and says so, with a counter that never stops. Nothing
@@ -1982,27 +2045,53 @@ export class CodexBackend {
                 skipCooldown: true,
                 skipRecoveryWait: true,
             },
-            // Workspace (team) accounts report exhaustion differently from personal
-            // ones — the full line is:
-            //   "■ Your workspace is out of credits. Ask your workspace owner to
-            //    refill in order to continue."
+            // Workspace (business) accounts report exhaustion differently from personal
+            // ones, with codex's own rows (codex-rs/protocol error.rs and tui
+            // turn_runtime.rs, unchanged 0.160.0–0.165.0):
+            //   member: "■ Your workspace is out of credits. Ask your workspace owner to refill in order to continue."
+            //           "■ You hit your spend cap set by the owner of your workspace. Ask an owner to increase your spend cap to continue."
+            //   owner:  "■ You're out of credits. Your workspace is out of credits. Add credits to continue using Codex."
+            //           "■ Your workspace is out of credits. Add credits to continue."
+            //           "■ You hit your spend cap set in your workspace. Increase your spend cap to continue."
+            //           "■ Usage limit reached. You've reached your usage limit. Increase your limits to continue using codex."
             // Neither `insufficient_quota|billing` nor `you've hit your usage limit`
-            // matches it, so this state went unreported.
+            // matches them.
             //
-            // `\s+` at each word gap: capture-pane runs without -J, so tmux's hard
-            // wrap can land a newline anywhere in the phrase. The `■` prefix and the
-            // "Ask your workspace owner…" tail are deliberately left out — the prefix
-            // is decoration and the tail is what would wrap.
+            // pause, not notify: nothing works until someone refills or raises the cap.
+            // Anchored to the status glyph in COLUMN 0, because these skip the
+            // usage-window check (a workspace limit is not one of those windows, so the
+            // check would call it "available"): codex draws its own error cells there,
+            // while an agent's message, quote or code block is indented under its `•`
+            // (captured live, tests/fixtures/codex-0165-workspace-quoted.pane.txt).
+            // `\s+` at each word gap: capture-pane runs without -J, so tmux's hard wrap
+            // can land a newline anywhere in the sentence. A resumed transcript reprints
+            // these rows, and the first live composer of a spawn takes them as history.
             {
-                pattern: /workspace\s+is\s+out\s+of\s+credits/i,
+                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+(?:You['’]re\s+out\s+of\s+credits\.\s+)?Your\s+workspace\s+is\s+out\s+of\s+credits\.`, "m"),
                 type: "quota",
-                // pause, not notify: exhausted credits are a dead end until someone
-                // refills, so leaving the instance running just burns cycles failing.
-                // Matches how the other terminal quota states behave (claude-code's
-                // "credit balance is too low", codex's own "you've hit your usage
-                // limit"). Costs a manual resume after the refill.
                 action: "pause",
                 message: "Codex workspace credits exhausted — workspace owner must refill",
+                notice: () => quotaPausedLine("Codex", "workspace_credits"),
+                skipUsageVerify: true,
+                historyUntilLiveComposer: true,
+            },
+            {
+                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+You\s+hit\s+your\s+spend\s+cap\s+set\s+(?:by\s+the\s+owner\s+of|in)\s+your\s+workspace\.`, "m"),
+                type: "quota",
+                action: "pause",
+                message: "Codex workspace spend cap reached — workspace owner must raise it",
+                notice: () => t("inst.quota_spend_cap"),
+                skipUsageVerify: true,
+                historyUntilLiveComposer: true,
+            },
+            {
+                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+Usage\s+limit\s+reached\.\s+You['’]ve\s+reached\s+your\s+usage\s+limit\.\s+Increase\s+your\s+limits`, "m"),
+                type: "quota",
+                action: "pause",
+                message: "Codex workspace usage limit reached — increase the workspace limits to continue",
+                notice: () => quotaPausedLine("Codex", "workspace_usage"),
+                skipUsageVerify: true,
+                historyUntilLiveComposer: true,
             },
             // Codex warns at 10% and 5% remaining, and scopes the limit by period —
             // "weekly" alone missed every `monthly limit` warning.
@@ -2021,28 +2110,14 @@ export class CodexBackend {
                 action: "notify",
                 message: "Codex usage limit running low",
                 formatMessage: (m) => `Codex ${m[2].toLowerCase()} limit: less than ${m[1]}% left`,
+                notice: (m) => (m ? quotaLowLine(m[2], m[1]) : quotaLine("Codex", "usage")),
             },
         ];
     }
     getStartupDialogs() {
         const trustHold = this.trustHoldDialog();
         return [
-            {
-                pattern: /^\s*Trust this folder\?/m,
-                keys: ["Enter"],
-                description: "Codex authorized folder trust dialog",
-                blocksDelivery: true,
-                inputBlocked: true,
-                autoResolutionKey: "codex-authorized-folder-trust",
-                isActive: pane => {
-                    const state = codexTrustPromptState(pane);
-                    const authorized = this.authorizedTrust;
-                    return state.active && state.safeChoice && authorized !== null
-                        && state.folder === authorized.cwd
-                        && (state.rootNote === "absent" ? authorized.root === authorized.cwd
-                            : state.rootNote === "parsed" && state.root === authorized.root);
-                },
-            },
+            this.autoTrustDialog(),
             trustHold,
             this.updatePickerDialog(),
             this.rateSwitchPickerDialog(),
@@ -2077,6 +2152,26 @@ export class CodexBackend {
             },
         ];
     }
+    /**
+     * The user's decision (hmsg-53600a2c): codex's folder-trust prompt in an AgEnD session is always answered Trust — the
+     * workspace is the agent's own, whatever preTrust covered (preTrust stays, so the prompt rarely shows at all). Enter,
+     * only with the cursor on "Trust and continue" among the known options (trustCursor); any other layout or row is
+     * held (trustHoldDialog). It trusts the folder only: per-action approvals are separate dialogs and are not touched.
+     */
+    autoTrustDialog() {
+        return {
+            pattern: /^\s*Trust this folder\?/m,
+            keys: ["Enter"],
+            description: "Codex folder trust — trusting the agent's own folder",
+            blocksDelivery: true,
+            inputBlocked: true,
+            autoResolutionKey: "codex-folder-auto-trust",
+            // One Enter per prompt (claimed, then checked): a prompt still up after it is held, never pressed again (#2896 review).
+            verifyAfterKeys: true,
+            isActive: pane => codexTrustPromptState(pane).trustCursor,
+            answerDetail: pane => ({ autoTrusted: true, ...this.trustPaneFields(pane) }),
+        };
+    }
     trustHoldDialog() {
         return {
             pattern: /^\s*(?:Folder access|Trust this folder\?|Do you trust the files in this folder\?)/im,
@@ -2086,8 +2181,42 @@ export class CodexBackend {
             blocksDelivery: true,
             inputBlocked: true,
             isActive: codexTrustVariantActive,
+            heldReason: pane => this.trustHoldReason(pane),
         };
     }
+    /**
+     * #2893: why the authorized folder-trust answer did not take this prompt (log only): what the pane shows against what
+     * preTrust authorized for this launch, and whether the instance's config trusts the folder codex is asking about. A
+     * field case of a held trust prompt then explains itself in daemon.log.
+     */
+    trustHoldReason(pane) {
+        const state = codexTrustPromptState(pane), authorized = this.authorizedTrust;
+        const configPath = join(this.isolatedCodexHome, "config.toml");
+        let configTrust = "unreadable";
+        if (state.folder) {
+            try {
+                configTrust = effectiveProjectTrust(readFileSync(configPath, "utf-8"), state.root ?? state.folder) ?? "absent";
+            }
+            catch { /* unreadable */ }
+        }
+        // The same test as the startup entry's authorized answer: when it holds, nothing differs — say so, never a mismatch.
+        const rootMatches = authorized !== null && (state.rootNote === "absent" ? authorized.root === authorized.cwd
+            : state.rootNote === "parsed" && state.root === authorized.root);
+        const authorizedMatch = state.active && state.safeChoice && authorized !== null && state.folder === authorized.cwd && rootMatches;
+        // hmsg-53600a2c: Trust is pressed whenever the cursor is on it; a hold is a layout, a row, or a press that did not take.
+        const reason = !state.active ? "a trust layout AgEnD never answers (Folder access options, or Do you trust the files…)"
+            : !state.trustCursor ? "the cursor is not on Trust and continue, or the options are not the known ones"
+                : "Trust was already pressed for this prompt and it is still up";
+        return { trustHoldReason: reason, authorizedMatch, promptFolder: state.folder, promptRoot: state.root, rootNote: state.rootNote,
+            authorizedCwd: authorized?.cwd ?? null, authorizedRoot: authorized?.root ?? null, configPath, configTrust };
+    }
+    /** What an auto-trust answered (log only): the folder and root on the prompt, what preTrust covered, and the config path. */
+    trustPaneFields(pane) {
+        const state = codexTrustPromptState(pane), authorized = this.authorizedTrust;
+        return { promptFolder: state.folder, promptRoot: state.root, rootNote: state.rootNote,
+            authorizedCwd: authorized?.cwd ?? null, authorizedRoot: authorized?.root ?? null,
+            configPath: join(this.isolatedCodexHome, "config.toml") };
+    }
     /**
      * #1008: the rate-limit model-switch picker parked unattended instances (it
      * waits forever and its default option changes the model). Prevention is
@@ -2163,6 +2292,24 @@ export class CodexBackend {
             },
         };
     }
+    workspaceLimitPromptDialog() {
+        // Escape via sendSpecialKey, the same as the Luna Reserve menu: never a paste
+        // (its implicit Enter would confirm the cursor's row) and never "y". The error
+        // row codex printed above the prompt stays, and the quota pause takes it from
+        // there: one notice, no parked dialog.
+        return {
+            pattern: /^\s*enter select\s*[·•]\s*esc back\s*$/im,
+            keys: ["Escape"],
+            description: "Codex workspace limit prompt — pressing Escape (never asking the owner)",
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexWorkspaceLimitPromptVisible,
+            verifyAfterKeys: true,
+            autoResolutionKey: "codex-workspace-limit-prompt",
+            answeredByAgend: true,
+            marksLiveIncident: true,
+        };
+    }
     unknownSelectionHoldDialog() {
         return {
             pattern: /^\s*[›❯>]\s+\S/m,
@@ -2176,6 +2323,7 @@ export class CodexBackend {
     }
     getRuntimeDialogs() {
         return [
+            this.autoTrustDialog(),
             this.trustHoldDialog(),
             this.rateSwitchPickerDialog(),
             {
@@ -2193,6 +2341,7 @@ export class CodexBackend {
             },
             this.updatePickerDialog(),
             this.usageLimitLunaReserveDialog(),
+            this.workspaceLimitPromptDialog(),
             ...this.sessionHoldDialogs(),
             this.unknownSelectionHoldDialog(),
         ];