npm - agent-dag - Versions diffs - 1.35.2 → 1.35.4 - Mend

agent-dag 1.35.2 → 1.35.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/dist/web/assets/{index-B4-a3WNi.js → index-Z6DVMogL.js} +2 -2
package/dist/web/index.html +1 -1
package/package.json +1 -1
package/src/server/codex-auth.mjs +11 -3
package/src/server/codex-dir.mjs +171 -0
package/src/server/codex-quota.mjs +5 -2
package/src/server/codex-usage.mjs +24 -31
package/src/server/index.mjs +110 -56
package/src/server/installer.mjs +6 -5

package/dist/web/index.html CHANGED Viewed

@@ -40,7 +40,7 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-B4-a3WNi.js"></script>
+    <script type="module" crossorigin src="/assets/index-Z6DVMogL.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-FKxgHN0p.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.35.2",
+  "version": "1.35.4",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/codex-auth.mjs CHANGED Viewed

@@ -14,12 +14,20 @@
 // a rejected promise from a background poll would take the server down.
 import { readFile, chmod, unlink, realpath } from "node:fs/promises";
 import { join } from "node:path";
-import { homedir } from "node:os";
+import { CODEX_HOME } from "./codex-dir.mjs";
 import { createTemp, renameWithRetry } from "./installer.mjs";
 import { PRODUCT } from "./brand.mjs";
-const CODEX_HOME = process.env.CODEX_HOME ?? join(homedir(), ".codex");
-const AUTH_PATH  = join(CODEX_HOME, "auth.json");
+// This file used to resolve CODEX_HOME itself, as `process.env.CODEX_HOME ??
+// join(homedir(), ".codex")`. `??` falls back on null and undefined only, so an
+// empty CODEX_HOME — what `export CODEX_HOME=$SOME_UNSET_VAR` leaves in a
+// profile — survived it, and join("", "auth.json") is the CWD-relative
+// "auth.json". Of all five readers this was the expensive one to get wrong: the
+// rotated refresh token below is single-use, so a write that lands in whatever
+// directory the deck was started from does not lose a read, it burns the
+// credential and costs the user a `codex login`. codex-dir.mjs owns the rule now
+// and treats an empty value as "not set" (#375).
+const AUTH_PATH = join(CODEX_HOME, "auth.json");
 // Same client id + endpoint the Codex CLI uses (codex-rs/login/src/auth/manager.rs).
 const CLIENT_ID   = process.env.CODEX_APP_SERVER_LOGIN_CLIENT_ID ?? "app_EMoamEEZ73f0CkXaXp7hrann";

package/src/server/codex-dir.mjs ADDED Viewed

@@ -0,0 +1,171 @@
+// Where OpenAI Codex lives on this machine: its home directory, its rollout
+// tree, and the walk over that tree — the Codex-side mirror of claude-dir.mjs.
+//
+// CODEX_HOME relocates ~/.codex wholesale, exactly as CLAUDE_CONFIG_DIR does on
+// the Claude side, and five modules used to answer the question for themselves
+// in three different spellings (#375):
+//
+//   index.mjs        CODEX_HOME ? resolve(CODEX_HOME) : join(homedir(), ".codex")
+//   installer.mjs    the same
+//   codex-usage.mjs  CODEX_HOME ? CODEX_HOME         : join(homedir(), ".codex")
+//   codex-auth.mjs   CODEX_HOME ?? join(homedir(), ".codex")
+//   codex-quota.mjs  the same
+//
+// The three spellings disagree on two inputs that a shell profile produces by
+// accident rather than by intent, and both disagreements are silent:
+//
+//   CODEX_HOME=""    — what `export CODEX_HOME=$SOME_UNSET_VAR` leaves behind.
+//     `??` only falls back on null and undefined, so the two modules spelled
+//     that way kept the empty string and then joined onto it: join("",
+//     "auth.json") is "auth.json", a CWD-RELATIVE path. codex-auth.mjs is the
+//     module that writes the rotated OpenAI refresh token back to disk, and
+//     OpenAI rotates that token single-use — so writing it to whatever
+//     directory the deck happened to be started from does not merely lose a
+//     read, it burns the credential and costs the user a `codex login`.
+//
+//   CODEX_HOME=./relative — kept verbatim by three of the five, so the tree
+//     they read was resolved against the CWD at the moment of each readdir()
+//     rather than once at startup. Two modules therefore read a different
+//     directory than the other three whenever the deck was started from
+//     anywhere but the parent of that relative path.
+//
+// This module is the single answer to all of it, and every reader now imports
+// it. The rule is the `resolve()` + truthiness form index.mjs and installer.mjs
+// already used, because it is the one the installer writes against and the one
+// that treats an empty value as "not set" — see codexHome() for why that is the
+// right way round rather than merely the majority.
+import { readdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, posix as posixPath, win32 as winPath } from "node:path";
+/**
+ * Absolute path of the Codex home directory: $CODEX_HOME or ~/.codex.
+ *
+ * WHY AN EMPTY VALUE FALLS BACK. An empty environment variable is not a path.
+ * It is what a shell leaves behind when the variable it was assigned from does
+ * not exist, and treating it as "the current directory" turns a typo in a
+ * profile into a deck that reads and WRITES Codex state in whatever directory
+ * it was launched from. Falling back to ~/.codex is the only reading that can
+ * be right by accident; there is no user who means "put my Codex credentials in
+ * $PWD" and spells it by leaving the variable empty.
+ *
+ * WHY IT IS TRIMMED. Same argument one step further: `CODEX_HOME=" "` is the
+ * same accident with a stray space in the profile line, and claudeConfigDir()
+ * has trimmed for exactly this reason since it was written. Trimming only ever
+ * removes leading and trailing whitespace, so a real path that CONTAINS spaces
+ * — `/Users/me/Library/Application Support/codex` — is untouched, which is the
+ * case worth protecting on macOS and Windows both.
+ *
+ * WHY resolve() AND NOT realpath(). resolve() makes a relative value absolute
+ * once, here, instead of leaving every later readdir() to resolve it against
+ * whatever the CWD is by then. It deliberately does NOT follow symlinks:
+ * ~/.codex is often a link into a dotfiles repo or an encrypted volume, and
+ * canonicalising it would (a) require the directory to already exist, which it
+ * does not before the first `codex login`, and (b) make the deck rename over
+ * the link's target instead of through the link — the very thing codex-auth.mjs
+ * resolves symlinks at WRITE time to avoid. A symlinked CODEX_HOME therefore
+ * stays spelled the way the user spelled it, on purpose.
+ *
+ * The environment, home directory and platform are parameters purely so this
+ * rule can be checked for a machine the author is not sitting at: the Windows
+ * answer — drive letters, backslashes, a trailing `\` — is only ever verifiable
+ * from a POSIX box if the path flavour follows the argument rather than the
+ * host, the same trick exec.mjs and claudeCliCandidates() already use. Every
+ * caller in the deck passes nothing and gets the real machine's answer.
+ */
+export function codexHome(env = process.env, home = homedir(), platform = process.platform) {
+  // The path flavour follows the PLATFORM ARGUMENT, not the host, so that a
+  // Windows value is normalised by Windows rules even when the check runs on a
+  // Mac. On a real machine `platform` is `process.platform`, which makes this
+  // the same `join`/`resolve` the module would have imported anyway.
+  const path = platform === "win32" ? winPath : posixPath;
+  const override = env.CODEX_HOME?.trim();
+  return override ? path.resolve(override) : path.join(home, ".codex");
+}
+/**
+ * Absolute path of the rollout tree: $CODEX_HOME/sessions.
+ *
+ * Codex writes one append-only JSONL file per session under
+ * sessions/YYYY/MM/DD/, and this directory is the root of every walk below. It
+ * lives here rather than being spelled `join(CODEX_HOME, "sessions")` at each
+ * of the three walkers, because that spelling was already duplicated verbatim
+ * in index.mjs and codex-usage.mjs and had no owner to drift away from.
+ */
+export function codexSessionsDir(env = process.env, home = homedir(), platform = process.platform) {
+  const path = platform === "win32" ? winPath : posixPath;
+  return path.join(codexHome(env, home, platform), "sessions");
+}
+/**
+ * The answers for THIS process, resolved once at load.
+ *
+ * Every consumer imports these constants rather than calling the functions,
+ * which is what makes it impossible for two modules to disagree: there is now a
+ * single evaluation in the whole process instead of one per importing module.
+ * The functions above stay exported because the constants cannot be re-derived
+ * for a hypothetical environment, and the rule they encode is the thing worth
+ * pinning against every shape a CODEX_HOME can take.
+ */
+export const CODEX_HOME = codexHome();
+export const CODEX_SESSIONS_DIR = codexSessionsDir();
+/**
+ * Returned from a walkRolloutDays visitor to end the walk immediately.
+ *
+ * A symbol rather than `true` because two of the three callers build their
+ * result by pushing into an array inside the visitor, and `Array.prototype.push`
+ * returns a number — a truthy-return protocol would have made "I collected two
+ * files" indistinguishable from "stop now".
+ */
+export const STOP = Symbol("stop-rollout-walk");
+/**
+ * Walk $CODEX_HOME/sessions/YYYY/MM/DD newest-first, handing each day directory
+ * and the names inside it to `onDay(dir, files)`.
+ *
+ * Three callers walked this tree with the same four nested readdir-and-continue
+ * blocks and differed only in the last few lines: find the file carrying a given
+ * session id (index.mjs), collect everything in the newest two day directories
+ * (index.mjs again, for the watcher), and collect everything whose filename
+ * timestamp falls inside a rolling window (codex-usage.mjs). The walk is the
+ * part that has to agree — a deck that tails one set of files and reports usage
+ * from another is reporting on a session it is not showing.
+ *
+ * EVERY LEVEL SWALLOWS ITS OWN ERROR, which is deliberate rather than lazy. The
+ * tree is written by another process while this one reads it: a day directory
+ * can be created between the listing of its month and the listing of itself, a
+ * year directory can be a broken symlink on a restored backup, and none of that
+ * is a reason to stop reading the other 364 days. A missing sessions/ directory
+ * is not an error at all — it is simply a machine where Codex has not run yet.
+ *
+ * `onYear` exists for the one caller that can rule out a whole year without
+ * opening it. Years arrive newest-first, so returning STOP from it ends the
+ * walk rather than skipping a year, which is what the caller wants: once the
+ * years are older than the window, so is everything after them.
+ */
+export async function walkRolloutDays(onDay, { sessionsDir = CODEX_SESSIONS_DIR, onYear = null } = {}) {
+  let years;
+  // Only four-digit names are Codex's own. The filter also keeps a stray
+  // `.DS_Store` or a `latest` symlink from costing a readdir that would fail.
+  try { years = (await readdir(sessionsDir)).filter(d => /^\d{4}$/.test(d)).sort().reverse(); }
+  catch { return; }
+  for (const year of years) {
+    if (onYear && (await onYear(year)) === STOP) return;
+    let months;
+    try { months = (await readdir(join(sessionsDir, year))).sort().reverse(); }
+    catch { continue; }
+    for (const month of months) {
+      let days;
+      try { days = (await readdir(join(sessionsDir, year, month))).sort().reverse(); }
+      catch { continue; }
+      for (const day of days) {
+        const dir = join(sessionsDir, year, month, day);
+        let files;
+        try { files = await readdir(dir); }
+        catch { continue; }
+        if ((await onDay(dir, files)) === STOP) return;
+      }
+    }
+  }
+}

package/src/server/codex-quota.mjs CHANGED Viewed

@@ -9,11 +9,14 @@
 // the UI when something was dropped instead of silently showing less.
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { homedir } from "node:os";
+import { CODEX_HOME } from "./codex-dir.mjs";
 import { getCodexAuth, forceCodexRefresh, isCredentialHost } from "./codex-auth.mjs";
 import { PRODUCT } from "./brand.mjs";
-const CODEX_HOME  = process.env.CODEX_HOME ?? join(homedir(), ".codex");
+// Resolved by codex-dir.mjs rather than here. This file used to spell it
+// `process.env.CODEX_HOME ?? join(homedir(), ".codex")`, which keeps an empty
+// CODEX_HOME instead of falling back — and then read a CWD-relative
+// "config.toml" for the base URL every credential below is sent to (#375).
 const CONFIG_PATH = join(CODEX_HOME, "config.toml");
 const DEFAULT_BASE = "https://chatgpt.com/backend-api";

package/src/server/codex-usage.mjs CHANGED Viewed

@@ -1,17 +1,12 @@
 // Aggregates Codex token usage from ~/.codex/sessions rollout JSONL files.
 // Unlike Claude, Codex has no CLI quota command — we derive usage from the
 // actual session logs for 5h and 7d rolling windows.
-import { readdir, open, stat } from "node:fs/promises";
+import { open, stat } from "node:fs/promises";
 import { join } from "node:path";
-import { homedir } from "node:os";
 import { StringDecoder } from "node:string_decoder";
+import { STOP, walkRolloutDays } from "./codex-dir.mjs";
 import { PRODUCT } from "./brand.mjs";
-const CODEX_HOME = process.env.CODEX_HOME
-  ? process.env.CODEX_HOME
-  : join(homedir(), ".codex");
-const CODEX_SESSIONS_DIR = join(CODEX_HOME, "sessions");
 // Cache results for 60s (lighter than Claude quota — reads more files)
 let _cache = null;
 let _cacheAt = 0;
@@ -168,35 +163,33 @@ function parseRolloutTime(filename) {
 }
 // List rollout files whose start times fall within the given window.
+//
+// The walk over $CODEX_HOME/sessions is shared with the two entry points in
+// index.mjs (codex-dir.mjs) rather than repeated here, so the files this counts
+// usage from are exactly the files the watcher tails. They used to be two
+// verbatim copies of the same four nested readdirs over two verbatim copies of
+// the same CODEX_SESSIONS_DIR — which is how one of them came to resolve a
+// relative CODEX_HOME differently from the other (#375).
 async function listRolloutFiles(sinceMs) {
   const out = [];
-  let years;
-  try { years = (await readdir(CODEX_SESSIONS_DIR)).filter(d => /^\d{4}$/.test(d)).sort().reverse(); }
-  catch { return out; }
   const nowMs = Date.now();
-  for (const y of years) {
-    // Skip years that can't possibly contain files within the window
-    if (parseInt(y, 10) < new Date(nowMs - sinceMs - 86400000).getFullYear()) break;
-    let months;
-    try { months = (await readdir(join(CODEX_SESSIONS_DIR, y))).sort().reverse(); } catch { continue; }
-    for (const m of months) {
-      let days;
-      try { days = (await readdir(join(CODEX_SESSIONS_DIR, y, m))).sort().reverse(); } catch { continue; }
-      for (const d of days) {
-        const dir = join(CODEX_SESSIONS_DIR, y, m, d);
-        let files;
-        try { files = await readdir(dir); } catch { continue; }
-        for (const f of files) {
-          if (!f.endsWith(".jsonl")) continue;
-          const t = parseRolloutTime(f);
-          if (t != null && nowMs - t <= sinceMs) {
-            out.push({ path: join(dir, f), startMs: t });
-          }
+  // Years arrive newest-first, so the first one that cannot hold a file in the
+  // window ends the walk: everything after it is older still. The extra day of
+  // slack covers a session that started just before the window and a filename
+  // timestamp that is UTC while the year directory is local time.
+  const oldestYear = new Date(nowMs - sinceMs - 86400000).getFullYear();
+  await walkRolloutDays(
+    (dir, files) => {
+      for (const f of files) {
+        if (!f.endsWith(".jsonl")) continue;
+        const t = parseRolloutTime(f);
+        if (t != null && nowMs - t <= sinceMs) {
+          out.push({ path: join(dir, f), startMs: t });
         }
       }
-    }
-  }
+    },
+    { onYear: y => (parseInt(y, 10) < oldestYear ? STOP : undefined) },
+  );
   return out;
 }

package/src/server/index.mjs CHANGED Viewed

@@ -10,6 +10,7 @@ import { dirname } from "node:path";
 import { createInterface } from "node:readline";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { claudeConfigDir } from "./claude-dir.mjs";
+import { CODEX_SESSIONS_DIR, STOP, walkRolloutDays } from "./codex-dir.mjs";
 import { PRODUCT } from "./brand.mjs";
 import { invokedName, renameNotice } from "./invoked-as.mjs";
 import { codexCwdInWorkspace, writesCodexLog } from "./log-writer.mjs";
@@ -634,17 +635,17 @@ function maybeResolveContext(payload) {
 //                              output_tokens, reasoning_output_tokens,
 //                              total_tokens}}}}
 // We resolve the rollout path lazily (cache sid→path), then read the tail
-// for usage + model. CODEX_HOME overrides ~/.codex.
-const CODEX_HOME = process.env.CODEX_HOME
-  ? resolve(process.env.CODEX_HOME)
-  : join(homedir(), ".codex");
-// Exported because bin/deck.js prints this path in the boot banner, and it used
-// to build its own `join(homedir(), ".codex", "sessions")` for the purpose —
-// which ignored CODEX_HOME and so named a directory that does not exist on any
+// for usage + model. CODEX_HOME overrides ~/.codex, and codex-dir.mjs owns that
+// rule for every module on the Codex side — this one used to spell it inline,
+// which is how five modules ended up with three spellings of it (#375).
+//
+// Re-exported because bin/deck.js prints this path in the boot banner, and it
+// used to build its own `join(homedir(), ".codex", "sessions")` for the purpose
+// — which ignored CODEX_HOME and so named a directory that does not exist on any
 // machine that sets it. Handing out the binding the watcher itself reads, rather
 // than a second computation of the same rule, is what makes the printed path and
 // the tailed path unable to disagree.
-export const CODEX_SESSIONS_DIR = join(CODEX_HOME, "sessions");
+export { CODEX_SESSIONS_DIR };
 const codexRolloutPathBySid = new Map();
 const lastCodexUsageReadAt = new Map();
 const pendingCodexUsageReads = new Set();
@@ -653,34 +654,19 @@ const CODEX_READ_THROTTLE_MS = 2500;
 async function findCodexRolloutPath(sid) {
   const cached = codexRolloutPathBySid.get(sid);
   if (cached) return cached;
-  // Walk year → month → day → files. Codex includes the sid in the filename
-  // (rollout-...-<sid>.jsonl) so a directory-scoped match is enough.
-  const tryYears = async () => {
-    try { return await readdir(CODEX_SESSIONS_DIR); } catch { return []; }
-  };
-  const years = (await tryYears()).sort().reverse(); // newest first
-  for (const y of years) {
-    let months;
-    try { months = (await readdir(join(CODEX_SESSIONS_DIR, y))).sort().reverse(); }
-    catch { continue; }
-    for (const m of months) {
-      let days;
-      try { days = (await readdir(join(CODEX_SESSIONS_DIR, y, m))).sort().reverse(); }
-      catch { continue; }
-      for (const d of days) {
-        const dayDir = join(CODEX_SESSIONS_DIR, y, m, d);
-        let files;
-        try { files = await readdir(dayDir); } catch { continue; }
-        const hit = files.find(f => f.includes(sid) && f.endsWith(".jsonl"));
-        if (hit) {
-          const full = join(dayDir, hit);
-          codexRolloutPathBySid.set(sid, full);
-          return full;
-        }
-      }
-    }
-  }
-  return null;
+  // Walk year → month → day → files, newest first. Codex includes the sid in the
+  // filename (rollout-...-<sid>.jsonl) so a directory-scoped match is enough.
+  // The walk itself lives in codex-dir.mjs, shared with the watcher's listing
+  // below and with codex-usage.mjs, so all three read one tree the same way.
+  let found = null;
+  await walkRolloutDays((dayDir, files) => {
+    const hit = files.find(f => f.includes(sid) && f.endsWith(".jsonl"));
+    if (!hit) return;
+    found = join(dayDir, hit);
+    return STOP;
+  });
+  if (found) codexRolloutPathBySid.set(sid, found);
+  return found;
 }
 /** Tail-read a Codex rollout JSONL. Returns the last token_count info block
@@ -788,7 +774,9 @@ function maybeResolveCodex(payload) {
 //   event_msg/user_message             → UserPromptSubmit (Codex ≤ 0.144)
 //   event_msg/item_completed/UserMessage → UserPromptSubmit (Codex ≥ 0.147)
 //   response_item/function_call        → PreToolUse
-//   response_item/function_call_output → PostToolUse
+//   response_item/function_call_output → PostToolUse / PostToolUseFailure,
+//                                        decided by the outcome line Codex
+//                                        prepends to the output (codexCallFailed)
 //   event_msg/token_count              → UsageObserved
 //   event_msg/task_started (+window)   → ModelObserved (context window)
 //   event_msg/task_complete            → Stop (the turn finished)
@@ -844,25 +832,13 @@ async function readLiveDecks() {
 // of history every tick.
 async function listRecentCodexRollouts() {
   const out = [];
-  let years;
-  try { years = (await readdir(CODEX_SESSIONS_DIR)).filter(d => /^\d{4}$/.test(d)).sort().reverse(); }
-  catch { return out; }
   let dayDirs = 0;
-  for (const y of years) {
-    let months;
-    try { months = (await readdir(join(CODEX_SESSIONS_DIR, y))).sort().reverse(); } catch { continue; }
-    for (const m of months) {
-      let days;
-      try { days = (await readdir(join(CODEX_SESSIONS_DIR, y, m))).sort().reverse(); } catch { continue; }
-      for (const d of days) {
-        const dir = join(CODEX_SESSIONS_DIR, y, m, d);
-        let files;
-        try { files = await readdir(dir); } catch { continue; }
-        for (const f of files) if (f.endsWith(".jsonl")) out.push(join(dir, f));
-        if (++dayDirs >= 2) return out;
-      }
-    }
-  }
+  await walkRolloutDays((dir, files) => {
+    for (const f of files) if (f.endsWith(".jsonl")) out.push(join(dir, f));
+    // Two day-directories deep is the whole point of this listing: it runs every
+    // tick, and anything older than that is a session no process will append to.
+    if (++dayDirs >= 2) return STOP;
+  });
   return out;
 }
@@ -989,14 +965,92 @@ export function codexObjToPayload(obj, sid, cwd) {
     if (pl.type === "custom_tool_call") {
       return { ...base, hook_event_name: "PreToolUse", tool_name: pl.name ?? "tool", tool_input: { patch: pl.input }, tool_use_id: pl.call_id, model };
     }
+    // #397: the outcome, not just the fact that an outcome arrived. This used
+    // to hardcode "PostToolUse" for both output types, and the reducer derives
+    // `ok` from the event NAME (`tc.ok = name === "PostToolUse"`) — so `ok` was
+    // structurally incapable of being false on the Codex path and a command
+    // that exited non-zero drew exactly like one that succeeded. Every surface
+    // that reads the flag inherited the lie: the burst dot, the tool row, the
+    // ToolModal styling, the detail-panel error count, and the session
+    // summary's "Errors" stat, which was therefore pinned at 0 for the life of
+    // a Codex session. `PostToolUseFailure` is the name the reducer already
+    // understands (it sets `ok = false` and writes an `errorPreview` from the
+    // response); nothing but this mapper was missing.
     if (pl.type === "function_call_output" || pl.type === "custom_tool_call_output") {
       const tool_response = pl.output != null ? parseCodexOutput(pl.output) : undefined;
-      return { ...base, hook_event_name: "PostToolUse", tool_use_id: pl.call_id, tool_response, model };
+      const name = codexCallFailed(pl.output) ? "PostToolUseFailure" : "PostToolUse";
+      return { ...base, hook_event_name: name, tool_use_id: pl.call_id, tool_response, model };
     }
   }
   return null;
 }
+/**
+ * The text parts of a Codex tool result, in the order Codex wrote them.
+ *
+ * Codex writes the result in two different containers and the deck sees both,
+ * so this is where the difference stops. Across the rollouts sampled here:
+ * `custom_tool_call_output.output` is an ARRAY of `{ type: "input_text", text }`
+ * parts (85/85, on 0.144 and 0.147 alike), and `function_call_output.output` is
+ * a bare string (32/32). The `{ output, metadata }` envelope `parseCodexOutput`
+ * unwraps was written by neither, but it is cheap to keep tolerating and the
+ * unwrapping already lives there, so the string case is routed through it
+ * rather than duplicating the guess.
+ */
+function codexOutputParts(output) {
+  if (output == null) return [];
+  if (Array.isArray(output)) {
+    return output.map(p => (p && typeof p.text === "string" ? p.text : ""));
+  }
+  const unwrapped = parseCodexOutput(output);
+  return typeof unwrapped === "string" ? [unwrapped] : [];
+}
+/**
+ * Did this Codex tool call actually fail?
+ *
+ * Codex prepends its own wrapper line to the tool's output and that line — not
+ * any structured field — is where the outcome lives. Verified against every
+ * tool result in this machine's CODEX_HOME:
+ *
+ *   0.144.5  exec         "Script completed"   75    "Script failed"   2
+ *   0.147.0  exec         "Script completed"    6    (no failure observed)
+ *   0.144.5  apply_patch  "Exit code: 0"        2
+ *   0.144.5  exec_command / run — bare string, no wrapper line at all      32
+ *
+ * The two CLI versions spell it IDENTICALLY, which is why one rule covers both
+ * and why this needs no version sniffing: 0.147 renamed the prompt event (see
+ * the `item_completed` branch above) but left the exec wrapper alone.
+ *
+ * Only the FIRST part's FIRST line is read, and that precision is load-bearing
+ * rather than tidiness. The wrapper line is at part index 0 in 85 of 85 results
+ * that have one; the later parts are the command's own stdout, and the command
+ * prints whatever it likes there. On this machine two exec results contain a
+ * line reading "Script error:" in part 1 — output from a script that ran fine
+ * under a wrapper that says "Script completed" — so a rule that scanned every
+ * part would paint two successful calls red. `\r` is stripped because the same
+ * wrapper is written by Codex on Windows.
+ *
+ * Silence means success, deliberately. A result with no wrapper line — every
+ * `function_call_output` on 0.144, and whatever container a future Codex
+ * invents — keeps today's behaviour of mapping to `PostToolUse`. Reporting an
+ * unknown outcome as a failure would trade one wrong colour for another, and
+ * this direction is the recoverable one: a missed failure is a call that draws
+ * as it always has, while a false failure puts a red dot and an "Errors" count
+ * on a session that did nothing wrong.
+ */
+function codexCallFailed(output) {
+  const first = codexOutputParts(output)[0];
+  if (typeof first !== "string") return false;
+  const head = first.split("\n")[0].replace(/\r$/, "");
+  if (/^Script failed\b/.test(head)) return true;
+  // apply_patch reports itself with an exit code instead of a word. Anything
+  // non-zero is a patch that did not apply.
+  const exit = /^Exit code:\s*(\d+)/.exec(head);
+  if (exit) return Number(exit[1]) !== 0;
+  return false;
+}
 function parseCodexOutput(raw) {
   if (typeof raw !== "string") return raw;
   try {

package/src/server/installer.mjs CHANGED Viewed

@@ -7,24 +7,25 @@
 // with __agent-dag and de-duped.
 import { readFile, mkdir, unlink, rename, open, stat, chmod } from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { homedir } from "node:os";
 import { join, resolve, dirname } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 import { claudeConfigDir } from "./claude-dir.mjs";
+import { CODEX_HOME } from "./codex-dir.mjs";
 import { shellQuoteArg } from "./exec.mjs";
 import { PRODUCT } from "./brand.mjs";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, "..", "..");
-const HOME = homedir();
 // Honours CLAUDE_CONFIG_DIR, exactly as CODEX_DIR honours CODEX_HOME below.
 // Without it the hooks land in a settings.json Claude Code never opens.
 const CLAUDE_DIR = claudeConfigDir();
-const CODEX_DIR = process.env.CODEX_HOME
-  ? resolve(process.env.CODEX_HOME)
-  : join(HOME, ".codex");
+// Both directories now come from the module that owns the rule rather than from
+// a copy of it here — claude-dir.mjs and codex-dir.mjs. The local name stays
+// because CODEX_DIR is what the rest of this file and its tests call it, and it
+// says what the value is FOR here: the directory hooks.json is taken out of.
+const CODEX_DIR = CODEX_HOME;
 // Single shared discovery dir — both providers' hook scripts post here so one
 // running agent-dag server can match either ecosystem's events. It follows the