@sumicom/quicksave 0.8.2 → 0.8.3

package/dist/handlers/messageHandler.js

@@ -6,7 +6,7 @@ import { CommitSummaryCliService, CommitSummaryCliError } from '../ai/commitSumm
 import { CommitSummaryStateStore } from '../ai/commitSummaryStore.js';
 import { SessionManager } from '../ai/sessionManager.js';
 import { ClaudeCodeProvider } from '../ai/claudeCodeProvider.js';
-import { CodexSdkProvider } from '../ai/codexSdkProvider.js';
+import { CodexAppServerProvider } from '../ai/codexAppServer/index.js';
 import { CodexLoginManager } from '../ai/codexLogin.js';
 import { getTerminalManager } from '../terminal/terminalManager.js';
 import { getFileBrowser } from '../files/fileBrowser.js';
@@ -14,19 +14,19 @@ import { getSessionRegistry } from '../ai/sessionRegistry.js';
 import { enrichEntry } from '../ai/enrichEntry.js';
 import { getEventStore } from '../storage/eventStore.js';
 import { readdir, stat, readFile } from 'fs/promises';
-import { existsSync, watch as fsWatch } from 'fs';
+import { existsSync } from 'fs';
 import { join, dirname, basename } from 'path';
 import { homedir } from 'os';
+import { spawnAppServer } from '../ai/codexAppServer/index.js';
 const VERSION_CHECK_INTERVAL_MS = 12 * 60 * 60 * 1000; // 12 hours
-// Local file read is essentially free + fs.watch invalidates on cache writes.
-// 5 min is just a safety net for missed-event cases (NFS, container fs, etc.).
-const CODEX_MODELS_FILE_TTL_MS = 5 * 60 * 1000;
-// API path hits OpenAI; keep its own longer TTL to avoid hammering the
-// endpoint when the user has no local Codex CLI cache file at all.
-const CODEX_MODELS_API_TTL_MS = 60 * 60 * 1000;
-// fs.watch on ~/.codex fires multiple events per write (rename + change on
-// many filesystems). Coalesce into one refresh per burst.
-const CODEX_MODELS_WATCH_DEBOUNCE_MS = 500;
+// model/list reflects the current authenticated account's available models.
+// 30 min strikes a balance: long enough to avoid spawning a fresh app-server
+// every PWA reload; short enough that plan upgrades / model rollouts surface
+// within the same session day. Force-refreshes still bypass the TTL.
+const CODEX_MODELS_TTL_MS = 30 * 60 * 1000;
+/** Shallow equality on a model list. Used to suppress no-op
+ *  `/codex/models` broadcasts after a TTL refresh that returned the
+ *  same list. */
 function codexModelListsEqual(a, b) {
     if (a === b)
         return true;
@@ -35,25 +35,46 @@ function codexModelListsEqual(a, b) {
     if (a.length !== b.length)
         return false;
     for (let i = 0; i < a.length; i++) {
-        if (a[i].id !== b[i].id || a[i].name !== b[i].name)
+        const ai = a[i], bi = b[i];
+        if (ai.id !== bi.id || ai.name !== bi.name)
             return false;
-        const aE = a[i].reasoningEfforts;
-        const bE = b[i].reasoningEfforts;
-        if (aE === bE)
-            continue;
-        if (!aE || !bE)
+        if (ai.defaultReasoningEffort !== bi.defaultReasoningEffort)
             return false;
-        if (aE.length !== bE.length)
+        if (ai.isDefault !== bi.isDefault)
             return false;
-        for (let j = 0; j < aE.length; j++)
-            if (aE[j] !== bE[j])
+        const aE = ai.reasoningEfforts, bE = bi.reasoningEfforts;
+        if (aE !== bE) {
+            if (!aE || !bE)
                 return false;
+            if (aE.length !== bE.length)
+                return false;
+            for (let j = 0; j < aE.length; j++)
+                if (aE[j] !== bE[j])
+                    return false;
+        }
     }
     return true;
 }
+/** Map a single `model/list` entry to the lean `CodexModelInfo` the PWA
+ *  picker consumes. Hidden models (e.g. `codex-auto-review`) are caller-
+ *  filtered before this runs. */
+function projectAppServerModel(m) {
+    const reasoningEfforts = [];
+    for (const opt of m.supportedReasoningEfforts) {
+        if (typeof opt.reasoningEffort === 'string')
+            reasoningEfforts.push(opt.reasoningEffort);
+    }
+    return {
+        id: m.id,
+        name: m.displayName || m.id,
+        reasoningEfforts: reasoningEfforts.length > 0 ? reasoningEfforts : undefined,
+        defaultReasoningEffort: m.defaultReasoningEffort,
+        isDefault: m.isDefault || undefined,
+    };
+}
 export class MessageHandler {
     repos;
-    agentVersion = '0.8.2';
+    agentVersion = '0.8.3';
     defaultRepoPath;
     clientRepos = new Map(); // peerAddress -> repoPath
     repoLocks = new Map(); // repoPath -> peerAddress holding lock
@@ -64,19 +85,17 @@ export class MessageHandler {
     /** Per-repo agent-owned commit summary state. The daemon wires the
      *  `state-updated` event to `connection.broadcast` (see service/run.ts). */
     commitSummaryStore = new CommitSummaryStateStore();
-    claudeService = new SessionManager([
-        new ClaudeCodeProvider(),
-        new CodexSdkProvider(),
-    ]);
+    claudeService;
     pushClient = null;
     latestVersionCache = null;
     versionCheckInFlight = null;
     codexModelsCache = null;
     codexModelsCheckInFlight = null;
     codexModelsUpdateHandler = null;
-    codexModelsWatcher = null;
-    codexModelsWatchDebounce = null;
-    /** Override for tests; defaults to `~/.codex`. */
+    /** Override for tests; defaults to `~/.codex`. Still consulted by
+     *  `getCodexLoginStatus` to read `auth.json`; no longer used for model
+     *  discovery (that flows through `model/list` against a short-lived
+     *  app-server instance). */
     codexCacheDir;
     codexLoginManager = new CodexLoginManager();
     onHistoryUpdated;
@@ -89,6 +108,8 @@ export class MessageHandler {
         this.availableRepos = repos;
         this.defaultRepoPath = repos.length > 0 ? repos[0].path : '';
         this.productionBuild = productionBuild;
+        this.claudeService = options?.sessionManager
+            ?? new SessionManager([new ClaudeCodeProvider(), new CodexAppServerProvider()]);
         this.codexCacheDir = options?.codexCacheDir ?? join(homedir(), '.codex');
         // Load explicit coding paths only (repos and coding paths are independent)
         if (codingPaths) {
@@ -134,44 +155,42 @@ export class MessageHandler {
         return this.versionCheckInFlight;
     }
     /**
-     * Resolve the Codex model list for the current user.
+     * Resolve the Codex model list for the current authenticated account.
      *
-     * Priority:
-     *   1. `~/.codex/models_cache.json` — the Codex CLI's own cache of
-     *      models the signed-in account can actually use. This is the
-     *      authoritative list for ChatGPT-OAuth logins (the common case)
-     *      and is kept fresh by the CLI itself. Reads are essentially free,
-     *      so we use a short 5min in-memory TTL — and `startCodexModelsWatcher`
-     *      invalidates the cache the moment the file is rewritten.
-     *   2. `OPENAI_API_KEY` env var + OpenAI `/v1/models` — fallback for
-     *      API-key users, who are rare but still supported. Held to a 1h
-     *      sub-TTL so we don't hammer OpenAI when the local cache is absent.
+     * Source: `model/list` against a short-lived `codex app-server` instance.
+     * The app-server already enforces account-scoped filtering — what we get
+     * back is exactly the list this user can actually invoke (e.g. ChatGPT
+     * users won't see `claude-*` models, API-key users see the API-tier list).
+     * That's what makes this source authoritative: previously we fell through
+     * three sources (`codex debug models` / on-disk cache file / OpenAI
+     * `/v1/models`) none of which knew the caller's plan, so the picker
+     * surfaced models that would later 400 with `BadRequest`.
      *
-     * Returns `null` when neither source is available (not logged in and no
-     * API key set). Concurrent calls are deduped.
+     * Returns `null` if the spawn fails or no models come back. Concurrent
+     * calls dedup via `codexModelsCheckInFlight`. Cache TTL is single-tier
+     * (30 min) — force-refresh bypasses it.
      */
     async fetchCodexModels(force = false) {
         if (!force && this.codexModelsCache) {
-            const ttl = this.codexModelsCache.source === 'file'
-                ? CODEX_MODELS_FILE_TTL_MS
-                : CODEX_MODELS_API_TTL_MS;
-            if (Date.now() - this.codexModelsCache.checkedAt < ttl) {
+            if (Date.now() - this.codexModelsCache.checkedAt < CODEX_MODELS_TTL_MS) {
                 return this.codexModelsCache.models;
             }
         }
         if (this.codexModelsCheckInFlight)
             return this.codexModelsCheckInFlight;
         this.codexModelsCheckInFlight = (async () => {
+            const before = this.codexModelsCache?.models;
             try {
-                const fromCache = await this.readCodexModelsCacheFile();
-                if (fromCache && fromCache.length > 0) {
-                    this.codexModelsCache = { models: fromCache, checkedAt: Date.now(), source: 'file' };
-                    return fromCache;
-                }
-                const fromApi = await this.fetchCodexModelsFromOpenAI();
-                if (fromApi && fromApi.length > 0) {
-                    this.codexModelsCache = { models: fromApi, checkedAt: Date.now(), source: 'api' };
-                    return fromApi;
+                const fromAppServer = await this.fetchCodexModelsFromAppServer();
+                if (fromAppServer && fromAppServer.length > 0) {
+                    this.codexModelsCache = { models: fromAppServer, checkedAt: Date.now() };
+                    // Broadcast to bus subscribers when the list actually changes.
+                    // Same dedup behavior as the previous file-watcher path so a TTL
+                    // refresh that comes back with the same models is silent.
+                    if (!codexModelListsEqual(before, fromAppServer)) {
+                        this.codexModelsUpdateHandler?.(fromAppServer);
+                    }
+                    return fromAppServer;
                 }
                 return null;
             }
@@ -184,6 +203,61 @@ export class MessageHandler {
         })();
         return this.codexModelsCheckInFlight;
     }
+    /**
+     * Spawn a short-lived `codex app-server`, run `initialize` + `model/list`,
+     * shut down. Filters out `hidden: true` models (e.g. `codex-auto-review`)
+     * so they don't leak into the picker. Returns `null` on any failure —
+     * caller treats null as "no source available, picker falls back to
+     * hard-coded defaults".
+     */
+    async fetchCodexModelsFromAppServer() {
+        let handle = null;
+        try {
+            handle = await spawnAppServer({
+                clientInfo: { name: 'quicksave-agent', title: 'Quicksave Agent', version: '0.0.0' },
+                capabilities: { experimentalApi: false, optOutNotificationMethods: null },
+            });
+            const res = await handle.rpc.request('model/list', { cursor: null, limit: null, includeHidden: false });
+            return res.data
+                .filter((m) => !m.hidden)
+                .map((m) => projectAppServerModel(m));
+        }
+        catch (err) {
+            console.warn('[codex-models] model/list failed:', err instanceof Error ? err.message : err);
+            return null;
+        }
+        finally {
+            if (handle) {
+                try {
+                    await handle.shutdown();
+                }
+                catch { /* best-effort */ }
+            }
+        }
+    }
+    /**
+     * Resolve a user-provided model into one the current account actually
+     * supports. If the cache is empty (model/list never succeeded) the
+     * requested value passes through — we'd rather try and let codex 400 than
+     * silently swallow a model the user explicitly chose. If the cache exists
+     * but the requested model isn't in it, we fall back to whichever model
+     * `model/list` flagged as `isDefault` (e.g. ChatGPT account picks `gpt-5.5`).
+     * Non-codex agents are pass-through; their model space is independent.
+     */
+    validateCodexModel(requested, agentId) {
+        if (agentId !== 'codex')
+            return requested;
+        const cached = this.codexModelsCache?.models;
+        if (!cached || cached.length === 0)
+            return requested;
+        if (requested && cached.some((m) => m.id === requested))
+            return requested;
+        const fallback = cached.find((m) => m.isDefault) ?? cached[0];
+        if (requested && fallback?.id !== requested) {
+            console.warn(`[codex-models] requested model "${requested}" not in account list; coercing to "${fallback?.id}"`);
+        }
+        return fallback?.id ?? requested;
+    }
     /** Snapshot accessor for the bus `/codex/models` subscription. */
     getCachedCodexModels() {
         return this.codexModelsCache?.models ?? [];
@@ -196,113 +270,19 @@ export class MessageHandler {
         this.codexModelsUpdateHandler = handler;
     }
     /**
-     * Watch the Codex CLI cache directory and refresh the in-memory model list
-     * the moment the CLI rewrites it (typically after a `codex` startup or
-     * upgrade). Tolerant of a missing `~/.codex` directory — falls back to TTL
-     * alone if the watch can't be set up. Idempotent.
+     * Prime the in-memory cache at daemon boot. No-op if already cached.
+     * Replaces the previous file-watcher path: there's no on-disk file we
+     * watch any more, so the only refresh trigger is TTL expiry (30 min)
+     * or an explicit `force=true` call. The eager prime keeps the first
+     * `/codex/models` subscriber from getting an empty snapshot.
      */
-    startCodexModelsWatcher() {
-        if (this.codexModelsWatcher)
-            return;
-        // Prime the in-memory cache so the first /codex/models subscriber gets a
-        // populated snapshot instead of an empty one (the handshake also fires
-        // this; dedup via codexModelsCheckInFlight makes it cheap).
+    primeCodexModelsCache() {
         void this.fetchCodexModels().catch(() => { });
-        try {
-            // Watch the directory rather than the file directly so we react to
-            // first-time creation too. Many editors / cli tools rewrite atomically
-            // (write tmp + rename), which fires events for the directory, not the
-            // old file inode.
-            this.codexModelsWatcher = fsWatch(this.codexCacheDir, (_event, filename) => {
-                if (filename && filename !== 'models_cache.json')
-                    return;
-                this.scheduleCodexModelsRefresh();
-            });
-        }
-        catch {
-            // Directory missing or unwatchable — quietly skip; the 5min TTL still
-            // catches the next refresh once a request comes in.
-        }
-    }
-    /** Tear down the fs.watch handle (test cleanup). */
-    stopCodexModelsWatcher() {
-        if (this.codexModelsWatchDebounce) {
-            clearTimeout(this.codexModelsWatchDebounce);
-            this.codexModelsWatchDebounce = null;
-        }
-        if (this.codexModelsWatcher) {
-            this.codexModelsWatcher.close();
-            this.codexModelsWatcher = null;
-        }
-    }
-    scheduleCodexModelsRefresh() {
-        if (this.codexModelsWatchDebounce)
-            clearTimeout(this.codexModelsWatchDebounce);
-        this.codexModelsWatchDebounce = setTimeout(() => {
-            this.codexModelsWatchDebounce = null;
-            void this.refreshCodexModelsAndPublish();
-        }, CODEX_MODELS_WATCH_DEBOUNCE_MS);
-    }
-    async refreshCodexModelsAndPublish() {
-        const before = this.codexModelsCache?.models;
-        const after = await this.fetchCodexModels(/* force */ true);
-        if (!after)
-            return;
-        if (codexModelListsEqual(before, after))
-            return;
-        this.codexModelsUpdateHandler?.(after);
-    }
-    /**
-     * Read models from the Codex CLI's local cache. File shape (as of codex
-     * CLI v0.125): `{ models: [{ slug, display_name, visibility, supported_in_api, ... }] }`.
-     * We surface only entries that are listable and API-supported, so hidden
-     * internal models (e.g. `codex-auto-review`) don't leak into the picker.
-     */
-    async readCodexModelsCacheFile() {
-        try {
-            const cachePath = join(this.codexCacheDir, 'models_cache.json');
-            const raw = await readFile(cachePath, 'utf-8');
-            const parsed = JSON.parse(raw);
-            if (!Array.isArray(parsed.models))
-                return null;
-            const models = parsed.models
-                .filter((m) => m.slug && m.visibility === 'list' && m.supported_in_api !== false)
-                .map((m) => ({ id: m.slug, name: m.display_name || m.slug }));
-            return models;
-        }
-        catch {
-            return null;
-        }
-    }
-    /** Fallback for API-key users (no ChatGPT OAuth). */
-    async fetchCodexModelsFromOpenAI() {
-        const apiKey = process.env.OPENAI_API_KEY;
-        if (!apiKey)
-            return null;
-        try {
-            const res = await fetch('https://api.openai.com/v1/models', {
-                headers: { Authorization: `Bearer ${apiKey}` },
-                signal: AbortSignal.timeout(10_000),
-            });
-            if (!res.ok)
-                return null;
-            const data = await res.json();
-            if (!Array.isArray(data.data))
-                return null;
-            return data.data
-                .filter((m) => /^(gpt-|o\d)/.test(m.id))
-                .map((m) => ({ id: m.id, name: m.id }))
-                .sort((a, b) => b.id.localeCompare(a.id));
-        }
-        catch {
-            return null;
-        }
     }
     /**
      * Best-effort check for whether the local Codex CLI has valid auth.
-     * Matches how `fetchCodexModels` resolves credentials, so the PWA can
-     * prompt for login when this returns false. Does not validate the
-     * token — just checks that a credential source exists.
+     * The PWA uses this to prompt for login when it returns false. Does not
+     * validate the token — just checks that a credential source exists.
      */
     async getCodexLoginStatus() {
         if (process.env.OPENAI_API_KEY)
@@ -383,7 +363,6 @@ export class MessageHandler {
         // They persist until the user reconnects and explicitly responds.
     }
     cleanup() {
-        this.stopCodexModelsWatcher();
         this.claudeService.cleanup();
     }
     getActiveSessionCount() {
@@ -536,6 +515,8 @@ export class MessageHandler {
                 return this.handleClaudeCancel(message);
             case 'claude:close':
                 return this.handleClaudeClose(message);
+            case 'claude:end-task':
+                return this.handleClaudeEndTask(message);
             case 'claude:user-input-response':
                 return this.handleClaudeUserInputResponse(message);
             case 'claude:set-preferences':
@@ -1577,12 +1558,18 @@ export class MessageHandler {
     // Claude Code SDK Handlers
     // ============================================================================
     async handleClaudeStart(message, peerAddress) {
-        const { prompt, cwd: payloadCwd, agent, allowedTools, systemPrompt, model, permissionMode, sandboxed } = message.payload;
+        const { prompt, cwd: payloadCwd, agent, allowedTools, systemPrompt, model, permissionMode, sandboxed, reasoningEffort, contextWindow } = message.payload;
         const legacyProvider = message.payload.provider;
         const cwd = payloadCwd || this.getClientRepoPath(peerAddress);
         const streamId = generateMessageId();
         const resolvedAgent = agent ?? (legacyProvider === 'codex-mcp' ? 'codex' : legacyProvider ? 'claude-code' : undefined);
-        console.log(`[agent:start] agent=${resolvedAgent ?? 'default'} model=${model ?? 'default'} cwd=${cwd} prompt=${prompt.slice(0, 80)}${sandboxed ? ' [sandboxed]' : ''}`);
+        // Coerce a Codex model the user's account doesn't actually support
+        // (e.g. they kept `claude-opus-4-7` selected before switching to a
+        // ChatGPT-account Codex session). Without this, codex would 400 on
+        // turn/start with `BadRequest`. Pass-through for non-codex agents and
+        // when the cache hasn't loaded yet.
+        const validatedModel = this.validateCodexModel(model, resolvedAgent ?? 'claude-code');
+        console.log(`[agent:start] agent=${resolvedAgent ?? 'default'} model=${validatedModel ?? 'default'}${validatedModel !== model ? ` (coerced from ${model})` : ''} cwd=${cwd} prompt=${prompt.slice(0, 80)}${sandboxed ? ' [sandboxed]' : ''}`);
         try {
             const sessionId = await this.claudeService.startSession({
                 prompt,
@@ -1591,9 +1578,11 @@ export class MessageHandler {
                 agent: resolvedAgent,
                 allowedTools,
                 systemPrompt,
-                model,
+                model: validatedModel,
                 permissionMode,
                 sandboxed,
+                reasoningEffort,
+                contextWindow,
             });
             console.log(`[agent:start] session created: ${sessionId} agent=${resolvedAgent ?? 'default'}`);
             // Register in session history
@@ -1618,6 +1607,9 @@ export class MessageHandler {
                 lastAccessedAt: now,
                 permissionMode,
                 sandboxed: sandboxed || undefined,
+                model,
+                reasoningEffort,
+                contextWindow,
             });
             this.onHistoryUpdated?.(cwd, registry.getEntry(cwd, sessionId), 'upsert');
             const response = createMessage('claude:start:response', { success: true, sessionId, streamId });
@@ -1696,6 +1688,36 @@ export class MessageHandler {
         response.id = message.id;
         return response;
     }
+    /**
+     * End Task: archive the session's registry entry, then terminate the live
+     * CLI process. Order matters — closeSession emits a session-updated whose
+     * `archived` flag is derived from "no in-memory entry AND no active
+     * registry entry". Archiving first ensures that emit carries archived=true,
+     * which the PWA reads as the "navigate away" signal.
+     *
+     * cwd lookup: prefer the live in-memory entry; fall back to the registry
+     * so users can still archive a stale active entry whose CLI has already
+     * exited (cold-closed sessions still appear in the drawer).
+     */
+    handleClaudeEndTask(message) {
+        const { sessionId } = message.payload;
+        const cwd = this.claudeService.getSessionCwd(sessionId)
+            ?? getSessionRegistry().findBySessionId(sessionId)?.cwd;
+        let archived = false;
+        if (cwd) {
+            const updated = getSessionRegistry().updateEntry(cwd, sessionId, { archived: true });
+            if (updated) {
+                archived = true;
+                this.onHistoryUpdated?.(cwd, updated, 'upsert');
+            }
+        }
+        const closed = this.claudeService.closeSession(sessionId);
+        const success = closed || archived;
+        console.log(`[agent:end-task] session=${sessionId} closed=${closed} archived=${archived} cwd=${cwd ?? 'unknown'}`);
+        const response = createMessage('claude:end-task:response', { success, error: success ? undefined : 'Session not found' });
+        response.id = message.id;
+        return response;
+    }
     handleClaudeUserInputResponse(message) {
         const resolved = this.claudeService.resolveUserInput(message.payload);
         console.log(`[agent:user-input-response] requestId=${message.payload.requestId} action=${message.payload.action} resolved=${resolved}`);
@@ -1747,7 +1769,21 @@ export class MessageHandler {
         return response;
     }
     async handleSetSessionConfig(message) {
-        const { sessionId, key, value } = message.payload;
+        const { sessionId, key } = message.payload;
+        let { value } = message.payload;
+        // Same coercion as handleClaudeStart: if the PWA pushed a model the
+        // current Codex account can't run, swap it for the account default
+        // before the override hits the next turn/start. The `agent` lookup
+        // tolerates inactive sessions (returns the registry-stored agent or
+        // falls back to the default provider).
+        if (key === 'model' && typeof value === 'string') {
+            const agentId = this.claudeService.getSessionAgent(sessionId);
+            const coerced = this.validateCodexModel(value, agentId);
+            if (coerced !== value) {
+                console.log(`[agent:set-config] coerced model "${value}" → "${coerced}" for session=${sessionId.slice(0, 8)}`);
+                value = coerced ?? value;
+            }
+        }
         console.log(`[agent:set-config] session=${sessionId.slice(0, 8)} ${key}=${String(value)}`);
         try {
             const config = await this.claudeService.setSessionConfig(sessionId, key, value);