agentbox-app 0.1.12 → 0.1.16

package/shared/spawn-trouble.mjs

@@ -61,12 +61,53 @@
 // to her subscription and never to a key (CLAUDE.md), so passing that advice on
 // would be this app telling her to do the one thing it refuses to do.
 import { NAME, Name } from '../shared/product-name.mjs';
+import { harnessDefinition } from './harness-definitions.mjs';
+import { instantIn, resetDay, wallIn } from './usage.mjs';
+
+// A CLAUDE CODE TOO OLD FOR THE LINE AGENTBOX STARTS IT WITH. Its argument
+// parser refuses the line before a single request, in one of two shapes,
+// measured on npm releases 2.1.70 back to 1.0.90 (2026-10-15):
+//
+//   error: option '--permission-mode <mode>' argument 'auto' is invalid. ...
+//   error: unknown option '--effort'
+//
+// ONLY FLAGS THE APP ITSELF SENDS, and only the mode value it sends. Somebody's
+// own session arguments can carry a typo, and an update does not fix a typo,
+// so an unknown flag of theirs stays 'unknown'. Anchored to the start of a
+// line because that is where the CLI prints it, and an agent quoting the same
+// words from some other program's output is not this.
+const CLAUDE = harnessDefinition('claude');
+const OUR_FLAGS = [
+  ...JSON.stringify(CLAUDE.run).match(/--[A-Za-z-]+/g),
+  '--allowedTools', '--disallowedTools', '--permission-mode', '--mcp-config', '--permission-prompt-tool', '--settings', '--model',
+];
+const TOO_OLD = [
+  new RegExp(`^error: unknown option '(${OUR_FLAGS.join('|')})'`, 'm'),
+  /^error: option '--permission-mode <mode>' argument 'auto' is invalid/m,
+];
 const ORG_BLOCKED = [
   /organi[sz]ation has disabled/i,
   /disabled for (your|this) organi[sz]ation/i,
   /ask your admin/i,
 ];
 
+// A CODEX SIGNED IN WITH AN API KEY. Our own line, said before the worker
+// starts (main/codex-account.mjs `codexKeyRefusal`), because Codex reads the
+// key out of auth.json past the worker scrub and bills every call to it.
+// Before SIGNED_OUT, whose /invalid api key/ is a different event.
+const API_KEY = [/signed in with an api key/i];
+
+// A CODEX config.toml CODEX WILL NOT READ. Codex's own words, off real runs of
+// codex-cli 0.160.0 on 2026-10-15: the app-server refusing `config/read` for a
+// quote left open or an old `profile = "..."` line, and the terminal's
+// "Error loading config.toml". Not benched like a login: fixing the file
+// changes no sign-in file, so a benched account would never come back.
+const CODEX_CONFIG = [
+  /refused config\/read: failed to (read configuration layers|resolve feature override)/i,
+  /error loading config\.toml/i,
+  /config\.toml:\d+:\d+: /i,
+];
+
 const SIGNED_OUT = [
   /oauth/i,
   /session expired/i,
@@ -133,7 +174,11 @@ const INTERRUPTED = [
   /connection (closed|lost|dropped)/i,
   /response stopped arriving/i,
   /may be incomplete/i,
-  /econnreset|enotfound|etimedout|econnrefused/i,
+  /econnreset|enotfound|etimedout|econnrefused|enetunreach|ehostunreach|eai_again/i,
+  // Codex also prefixes non-network failures with "stream disconnected".
+  // Match the request failure itself so incomplete responses keep their limit.
+  /error sending request for url/i,
+  /failed to send websocket request/i,
   /unable to connect/i,
   /can.{0,3}t reach the api/i,
   /timed out/i,
@@ -141,6 +186,34 @@ const INTERRUPTED = [
   /overloaded/i,
 ];
 
+// A NETWORK THAT WILL NOT LET A SECURE CONNECTION THROUGH (2026-10-15).
+//
+// A company network that inspects TLS swaps in its own certificate, and a
+// proxy can ask for a login. Neither clears by waiting, which is what made
+// 'interrupted' the wrong home for them: the real Claude Code 2.1.301 behind a
+// self-signed proxy died in 371 ms with "API Error: Unable to connect to API:
+// Self-signed certificate detected (DEPTH_ZERO_SELF_SIGNED_CERT) ...", "unable
+// to connect" filed it as a dropped connection, and the screen said there was
+// nothing to do. Node's own spellings, Codex's (rustls and OpenSSL) and a
+// proxy's 407 are here too. A REFUSED connection is not: "Connection refused
+// — a firewall or proxy may be blocking it (ECONNREFUSED)" is also what an
+// offline laptop prints.
+//
+// The fix is a setting the person's terminal already has, and since
+// main/shell-path.mjs the app reads it from their shell profile at launch, so
+// the sentence says to put it there and reopen the app.
+const NETWORK = [
+  /self[- ]signed certificate/i,
+  /unable to get local issuer certificate/i,
+  /unable to verify the first certificate/i,
+  /\b(DEPTH_ZERO_SELF_SIGNED_CERT|SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_GET_ISSUER_CERT_LOCALLY|UNABLE_TO_VERIFY_LEAF_SIGNATURE)\b/,
+  /tls_untrusted_ca/i,
+  /invalid peer certificate/i,
+  /certificate verify failed/i,
+  /proxy authentication required/i,
+];
+const NETWORK_FIX = 'export HTTPS_PROXY and NODE_EXTRA_CA_CERTS in your shell profile';
+
 // A workspace the CLI refuses to run in. Distinct from the two above because
 // the fix is a folder, not an account.
 const WORKSPACE = [
@@ -164,17 +237,50 @@ const WORKSPACE = [
   /skip-git-repo-check/i,
 ];
 
+// A MODEL THE LOGIN'S PLAN DOES NOT INCLUDE. Not the account being out and not
+// the model being unknown: the same login runs every other model, and another
+// login on a bigger plan runs this one. Codex's own words, off two dead runs on
+// 2026-10-09 and 2026-10-11 (codex-cli 0.160.0, a free-plan login handed
+// gpt-6.1-sol): "The 'gpt-6.1-sol' model is not supported when using Codex with
+// a ChatGPT account." The other two are ours, thrown before the thread starts
+// by `codexModelRefusal`: this login's list lacks it, or no login's list here
+// has it, which is what a paid plan that has ended looks like.
+const MODEL_NOT_ON_PLAN = [
+  /model is not supported when using codex with a chatgpt account/i,
+  /not a model the plan of the codex account/i,
+  /not a model the codex on this computer knows/i,
+];
+
+// Ours too, from `codexEffortRefusal`.
+const LEVEL_NOT_OFFERED = [/not a level that model offers/i];
+
+// Codex lets one process write to a conversation at a time, and refuses our
+// resume while the Codex app or a terminal has it open. codex-cli 0.163.0:
+// "thread <id> already has an active writer".
+const OPEN_ELSEWHERE = [/already has an active writer/i];
+
 // WHICH OF THE THREE THINGS WENT WRONG, from whatever the tool printed.
 // 'unknown' is a first-class answer, not a failure: an honest generic sentence
 // beats a confident wrong one.
 export function troubleCause(raw) {
   const text = String(raw ?? '');
   if (!text.trim()) return 'unknown';
+  // The CLI's own argument check, before any account is asked anything.
+  if (TOO_OLD.some((re) => re.test(text))) return 'too-old';
+  if (CODEX_CONFIG.some((re) => re.test(text))) return 'codex-config';
+  if (API_KEY.some((re) => re.test(text))) return 'api-key';
   // FIRST, because an organization's refusal mentions the subscription and
   // reads as a signed-out login to the list below.
   if (ORG_BLOCKED.some((re) => re.test(text))) return 'org-blocked';
+  // BEFORE SIGNED-OUT, because Codex's sentence says "ChatGPT account".
+  if (MODEL_NOT_ON_PLAN.some((re) => re.test(text))) return 'model-not-on-plan';
+  if (LEVEL_NOT_OFFERED.some((re) => re.test(text))) return 'level-not-offered';
+  if (OPEN_ELSEWHERE.some((re) => re.test(text))) return 'open-elsewhere';
   if (SIGNED_OUT.some((re) => re.test(text))) return 'signed-out';
   if (AT_LIMIT.some((re) => re.test(text))) return 'at-limit';
+  // BEFORE WORKSPACE, whose /untrusted/ would read a certificate as a folder,
+  // and before INTERRUPTED, whose "unable to connect" is in Claude Code's line.
+  if (NETWORK.some((re) => re.test(text))) return 'network';
   if (WORKSPACE.some((re) => re.test(text))) return 'workspace';
   // LAST ON PURPOSE, so every text that already had a name keeps it. A dropped
   // connection is the weakest of the four claims: an account that is signed out
@@ -184,22 +290,118 @@ export function troubleCause(raw) {
   return 'unknown';
 }
 
-// WHEN THE LIMIT LETS GO, straight off the line the CLI printed.
+// A SUBSCRIPTION THAT HAS ENDED IS REFUSED IN AN ADMIN'S WORDS. Claude Code
+// 2.1.293 told a lapsed personal Max login "Your organization has disabled
+// Claude subscription access for Claude Code" (2026-10-11), the same line a
+// workspace policy prints, so the text alone cannot tell them apart. The
+// login's own file can: `plan` is main/claude-plan.mjs's reading of it, and
+// `ended` is its billing gone to "none". Anything else keeps its cause.
+// A LOGIN THAT RAN OUT AND ONE NOBODY EVER MADE REFUSE IN THE SAME WORDS, and
+// the second is what somebody who skipped setup meets: "Sign that account back
+// in" about an account they never had. `everSignedIn` is the caller's reading
+// of the login's own files; false only where that reading is proof.
+export function refineCause(cause, plan, { everSignedIn = true } = {}) {
+  if (cause === 'org-blocked' && plan?.ended) return 'subscription-ended';
+  if (cause === 'signed-out' && !everSignedIn) return 'no-plan';
+  return cause;
+}
+
+// THE CLOCK A LIMIT LINE NAMES, AND THE ZONE IT NAMED IT IN.
+//
+// The zone used to be dropped on the floor, on the assumption that the CLI
+// prints the clock the Mac is already set to. A run on the cloud prints the
+// cloud machine's: "resets 12:10am (UTC)" reached a Mac on Pacific time
+// (2026-10-16), and both the hour on the row and the moment the fleet waited
+// for were seven hours out. `offset` is minutes east of UTC, and null when
+// the line printed no zone at all — which is still most lines, and still
+// means local. This reads any offset, and reads it for the sentence as well
+// as for the bench, which the first fix for that incident did not.
+//
+// Both wordings are real: the CLI's own line is "resets 6pm" and the API's is
+// "Your weekly limit resets at 4pm", so the "at" is optional.
+function resetClock(raw) {
+  const m = /resets\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*(?:\(\s*(?:UTC|GMT)\s*(?:([+-])(\d{1,2})(?::?(\d{2}))?)?\s*\))?/i
+    .exec(String(raw ?? ''));
+  if (!m) return null;
+  const zoned = /\(\s*(?:UTC|GMT)/i.test(m[0]);
+  return {
+    h: (Number(m[1]) % 12) + (m[3].toLowerCase() === 'pm' ? 12 : 0),
+    min: Number(m[2] ?? 0),
+    offset: zoned ? (m[4] === '-' ? -1 : 1) * (Number(m[5] ?? 0) * 60 + Number(m[6] ?? 0)) : null,
+  };
+}
+
+// The CLI's own wording for a clock time, so a converted hour reads exactly
+// the way a quoted one always has.
+function clockWords(h, min) {
+  return `${h % 12 || 12}${min ? `:${String(min).padStart(2, '0')}` : ''}${h < 12 ? 'am' : 'pm'}`;
+}
+
+// "3:15pm" today, "Wed 2:30pm" this week, "Wed Oct 28 1:05pm" further out,
+// the same day words the account meters use.
+function momentWords(ms, from) {
+  const d = new Date(ms);
+  const day = resetDay(ms, from);
+  return `${day ? `${day} ` : ''}${clockWords(d.getHours(), d.getMinutes())}`;
+}
+
+// WHEN THE LIMIT LETS GO, IN THE CLOCK SHE IS LOOKING AT.
 //
 // carries the one thing she actually wants to know, and we were throwing it
-// away and then telling her the vaguer "when the limit resets". The timezone
-// is dropped rather than shown: the limit line prints the zone the Mac is
-// already set to, so naming it would only add a word she has to read. Null when there is no time to quote, and then
-// the sentence falls back to the wording that has always been there.
-export function limitResetsAt(raw) {
-  // Both wordings are real: the CLI's own line is "resets 6pm" and the API's
-  // is "Your weekly limit resets at 4pm", so the "at" is optional.
-  const m = /resets\s+(?:at\s+)?(\d{1,2}(?::\d{2})?\s*(?:am|pm))/i.exec(String(raw ?? ''));
-  return m ? m[1].replace(/\s+/g, '').toLowerCase() : null;
+// away and then telling her the vaguer "when the limit resets". A line that
+// names its own zone is converted to this Mac's clock rather than quoted, so
+// the hour on the row is an hour she can act on; a line that names none is
+// already local and is quoted as it stands. Null when there is no time to
+// quote, and then the sentence falls back to the wording that has always been
+// there.
+export function limitResetsAt(raw, from = Date.now()) {
+  const clock = resetClock(raw);
+  if (!clock) {
+    // A reset on another day ("resets Oct 22 at 4pm", Codex's "try again at
+    // Oct 28th, 2026 1:05 PM") has no bare hour to quote.
+    const moment = limitResetMoment(raw, from);
+    return moment == null ? null : momentWords(moment, from);
+  }
+  if (clock.offset == null) return clockWords(clock.h, clock.min);
+  const at = new Date(limitResetMoment(raw, from));
+  return clockWords(at.getHours(), at.getMinutes());
 }
 
 const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec'];
 
+const CLAUDE_DAY = /resets\s+([a-z]{3})[a-z]*\.?\s+(\d{1,2})\s+at\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*(?:\(\s*([^)]+?)\s*\))?/i;
+const UTC_ZONE = /^(?:UTC|GMT)\s*(?:([+-])(\d{1,2})(?::?(\d{2}))?)?$/i;
+
+// "UTC", "GMT+2" or a place such as "America/Los_Angeles". A zone this
+// computer cannot name, or none, is its own clock.
+function zoneOf(word) {
+  const utc = UTC_ZONE.exec(word ?? '');
+  if (utc) return { offset: (utc[1] === '-' ? -1 : 1) * (Number(utc[2] ?? 0) * 60 + Number(utc[3] ?? 0)), name: null };
+  return { offset: null, name: word && wallIn(Date.now(), word) ? word : null };
+}
+
+// The moment a dated Claude Code reset names, or null. The line has no year,
+// so it is the year in that zone at `from`, or the next one when that puts the
+// reset more than a day behind (December reading a January date).
+function claudeResetDay(raw, from) {
+  const m = CLAUDE_DAY.exec(String(raw ?? ''));
+  if (!m) return null;
+  const month = MONTHS.indexOf(m[1].toLowerCase());
+  if (month < 0) return null;
+  const day = Number(m[2]);
+  const h = (Number(m[3]) % 12) + (m[5].toLowerCase() === 'pm' ? 12 : 0);
+  const min = Number(m[4] ?? 0);
+  const zone = zoneOf(m[6]);
+  const at = (year) => zone.offset != null
+    ? Date.UTC(year, month, day, h, min) - zone.offset * 60_000
+    : instantIn(year, month, day, h, min, zone.name);
+  const year = zone.offset != null
+    ? new Date(from + zone.offset * 60_000).getUTCFullYear()
+    : (wallIn(from, zone.name)?.year ?? new Date(from).getFullYear());
+  const moment = at(year);
+  return moment < from - 86_400_000 ? at(year + 1) : moment;
+}
+
 // THE SAME HOUR AS A MOMENT, so the fleet can wait exactly until it
 // (a limit that reset at, say, 6:50pm could hold every agent until 7:03pm,
 // because the app waited a fixed thirty minutes instead of reading this line).
@@ -217,15 +419,26 @@ export function limitResetMoment(raw, from = Date.now()) {
       return new Date(Number(dated[3]), month, Number(dated[2]), h, Number(dated[5]), 0, 0).getTime();
     }
   }
-  const hour = limitResetsAt(raw);
-  if (!hour) return null;
-  const m = /^(\d{1,2})(?::(\d{2}))?(am|pm)$/.exec(hour);
-  if (!m) return null;
-  const h = (Number(m[1]) % 12) + (m[3] === 'pm' ? 12 : 0);
-  const d = new Date(from);
-  d.setHours(h, Number(m[2] ?? 0), 0, 0);
-  if (d.getTime() < from - 60_000) d.setDate(d.getDate() + 1);
-  return d.getTime();
+  // Claude Code names the day when the reset is not today: "resets Oct 22 at
+  // 4pm (America/Los_Angeles)".
+  const datedReset = claudeResetDay(raw, from);
+  if (datedReset != null) return datedReset;
+  const clock = resetClock(raw);
+  if (!clock) return null;
+  if (clock.offset == null) {
+    const d = new Date(from);
+    d.setHours(clock.h, clock.min, 0, 0);
+    if (d.getTime() < from - 60_000) d.setDate(d.getDate() + 1);
+    return d.getTime();
+  }
+  // The named zone's own calendar day is not this Mac's, so the candidate is
+  // built in UTC and then walked to the one occurrence that sits in the next
+  // twenty-four hours. The grace is for the two clocks disagreeing by seconds.
+  const asked = new Date(from);
+  let t = Date.UTC(asked.getUTCFullYear(), asked.getUTCMonth(), asked.getUTCDate(), clock.h, clock.min) - clock.offset * 60_000;
+  while (t < from - 60_000) t += 86_400_000;
+  while (t - from >= 86_400_000) t -= 86_400_000;
+  return t;
 }
 
 // AN ACCOUNT THAT CANNOT BE USED AT ALL UNTIL A PERSON DOES SOMETHING.
@@ -237,18 +450,32 @@ export function needsHerHands(cause) {
   // same person: one is her, in a terminal; one is an admin of a workspace she
   // may not run. What they share is the only thing this question asks — trying
   // again in thirty minutes cannot possibly help.
-  return cause === 'signed-out' || cause === 'org-blocked';
+  // An out-of-date Claude Code is hers too: no retry updates it, and every run
+  // until she does spends nothing but a reply's tries.
+  // A Codex signed in with a key is hers as well, and `codex login` rewrites
+  // auth.json, which is what brings a benched account back.
+  return cause === 'signed-out' || cause === 'no-plan' || cause === 'org-blocked' || cause === 'subscription-ended' || cause === 'too-old' || cause === 'api-key';
 }
 
+// THE ONE COMMAND THAT UPDATES IT, WHEREVER IT CAME FROM. `claude update`
+// updates a native install itself and, on a Homebrew one, prints the brew line
+// to run instead (read in 2.1.80's own code), so it is the right first thing
+// to type whatever she installed it with.
+const UPDATE = `run claude update in a terminal (${Name} needs version ${CLAUDE.minVersion} or newer)`;
+
 // WHAT SHE READS WHEN NOT ONE AGENT CAN START ANYWHERE.
 // Not "an error occurred". The subject of the sentence is the thing she cares
 // about, which is her agents, and the reason follows it in plain words.
 export function troubleSentence(cause) {
   if (cause === 'signed-out') return 'No agents can start. Your Claude login has run out.';
+  if (cause === 'no-plan') return 'No agents can start. No AI plan is set up on this computer.';
   if (cause === 'org-blocked') return 'No agents can start. Your organization has turned Claude Code off.';
+  if (cause === 'subscription-ended') return 'No agents can start. Your Claude subscription has ended.';
   if (cause === 'at-limit') return 'No agents can start. Your Claude plan is at its limit.';
   if (cause === 'workspace') return 'No agents can start. Claude will not run in this folder.';
   if (cause === 'interrupted') return 'No agents can start. The connection to Claude keeps dropping.';
+  if (cause === 'network') return 'No agents can start. This network will not let them connect securely.';
+  if (cause === 'too-old') return 'No agents can start. Claude Code on this computer is too old.';
   return 'No agents can start on this computer right now.';
 }
 
@@ -259,10 +486,14 @@ export function troubleRemedy(cause) {
   // ). "Sign in to Claude again" is a thing to go and work out; /login is a
   // thing to type.
   if (cause === 'signed-out') return 'Open Claude in a terminal, type /login, and they pick straight back up.';
+  if (cause === 'no-plan') return `Set one up ${SET_UP_A_PLAN} and they pick straight up.`;
   if (cause === 'org-blocked') return 'Ask an admin of that Claude workspace to turn Claude Code back on.';
+  if (cause === 'subscription-ended') return 'Renew it at claude.ai and they pick straight up.';
   if (cause === 'at-limit') return 'They start again on their own when it resets.';
   if (cause === 'workspace') return 'Open the folder in Claude once and say yes to trusting it.';
   if (cause === 'interrupted') return `Nothing to do. ${Name} tries them again on its own.`;
+  if (cause === 'network') return `If your company uses a proxy or its own certificate, ${NETWORK_FIX} and reopen ${Name}.`;
+  if (cause === 'too-old') return `To update it, ${UPDATE}. They start again on their own.`;
   return `${Name} keeps trying on its own.`;
 }
 
@@ -289,10 +520,17 @@ export function accountSentence(cause, dir) {
   if (cause === 'org-blocked') {
     return 'Signed in, but its organization has turned Claude Code off. Only an admin of that workspace can turn it back on.';
   }
-  if (cause === 'at-limit') return 'At its limit. It rejoins on its own when the limit resets.';
+  if (cause === 'subscription-ended') return 'Signed in, but its Claude subscription has ended. Renew it at claude.ai to use this account again.';
+  if (cause === 'at-limit') return 'At its limit. Agents start again on their own when it resets.';
   if (cause === 'workspace') return 'Claude would not run in the folder this was asked to work in.';
   if (cause === 'interrupted') return `Its runs keep getting cut off. ${Name} is trying them again.`;
-  return `Its sessions are dying on arrival. ${Name} is keeping the other one busy.`;
+  // NOT THE ACCOUNT, and said so, because this is the page where she would
+  // otherwise go and sign it in again.
+  if (cause === 'network') return `The account is fine; this network will not let it connect securely. Set your company's proxy or certificate in your shell profile and reopen ${Name}.`;
+  // Not this account either: every account here runs the same Claude Code.
+  if (cause === 'too-old') return `Claude Code on this computer is too old. To update it, ${UPDATE}.`;
+  // A cause we cannot name points at the account, not at the app (2026-10-11).
+  return 'Claude Code would not start on this account. Check that its plan is active at claude.ai.';
 }
 
 /* ------------------ the same fact about a whole ENGINE -------------------- */
@@ -329,6 +567,9 @@ export function engineTroubleNote(cause, engineWord = 'Codex') {
   if (cause === 'at-limit') return `${engineWord} is at its usage limit, so its tasks are waiting. They start again on their own when it resets.`;
   if (cause === 'workspace') return `${engineWord} would not run in the folder a task asked to work in. Open that folder in ${engineWord} once and allow it.`;
   if (cause === 'interrupted') return `${engineWord} runs keep getting cut off. ${Name} is trying them again on its own.`;
+  if (cause === 'network') return `${engineWord} cannot connect securely through this network, so its tasks are not moving. Set your company's proxy or certificate in your shell profile and reopen ${Name}.`;
+  if (cause === 'api-key') return `${engineWord} is signed in with an API key, which ${Name} never bills, so nothing runs on it. Open a terminal, run codex login, and sign in with ChatGPT.`;
+  if (cause === 'codex-config') return `${engineWord} could not read its config.toml, so nothing runs on it. Run codex in a terminal to see the line it points at, and fix it.`;
   return `${engineWord} sessions are dying on arrival, so its tasks are not moving. ${Name} keeps trying.`;
 }
 
@@ -437,11 +678,42 @@ const DEAD_RUN_OPENERS = {
   workspace: "would not start in this project's folder, so nothing has been done here.",
   'signed-out': 'could not sign in, so nothing has been done on this task.',
   'org-blocked': 'is switched off for that account by its organization, so nothing has been done.',
+  'subscription-ended': "cannot run because that account's Claude subscription has ended, so nothing has been done.",
   'at-limit': 'is at its usage limit, so nothing has been done on this task.',
   interrupted: 'was cut off in the middle, so nothing has been done on this task.',
+  'model-not-on-plan': "could not use this task's model on that account's plan, so nothing has been done.",
+  'level-not-offered': "could not run this task's model at the thinking level it asks for, so nothing has been done.",
+  network: 'could not connect securely through this network, so nothing has been done on this task.',
+  'too-old': `on this computer is older than ${Name} needs, so nothing has been done on this task.`,
+  'api-key': `is signed in with an API key, which ${Name} never bills, so nothing has been done.`,
+  'codex-config': 'could not read its config.toml, so nothing has been done on this task.',
+  'open-elsewhere': 'has this conversation open in another window, so nothing has been done here.',
+  // THE ONE OPENER WITH NO ENGINE IN FRONT OF IT: somebody who has set nothing
+  // up has never heard of Codex, and the plan screens never say the word.
+  'no-plan': 'No AI plan is set up on this computer, so nothing has been done on this task.',
   unknown: 'stopped before it did anything, so this task has not been started.',
 };
 
+// WHERE A PLAN GETS SET UP: the bar across the top of the inbox (`PlanBar`),
+// which is the only way back into setup. Said once, for the four places that
+// point at it.
+const SET_UP_A_PLAN = 'at the top of your inbox';
+
+// The same, for a run that used a tool before it died, so "nothing has been
+// done" would be false. Kept out of DEAD_RUN_OPENERS so `deadRunCause` does
+// not count the row among those nothing has started on. A cause missing here
+// can only stop a run before its first tool, so on a run that worked it is a
+// misreading and gets the plain line.
+const WORKED_OPENERS = {
+  'signed-out': 'was signed out partway through, so this task is not finished.',
+  'org-blocked': 'was switched off for that account partway through, so this task is not finished.',
+  'subscription-ended': "stopped partway through because that account's subscription ended.",
+  'at-limit': 'hit its usage limit partway through, so this task is not finished.',
+  interrupted: 'was cut off partway through, so this task is not finished.',
+  network: 'lost its secure connection partway through, so this task is not finished.',
+  unknown: 'stopped partway through and did not finish this task.',
+};
+
 /**
  * THE LINE IN A THREAD WHERE A RUN STOPPED, in our words.
  *
@@ -453,10 +725,19 @@ const DEAD_RUN_OPENERS = {
  */
 const RUN_STOPPED = {
   'signed-out': 'This run stopped because the account was signed out.',
-  'org-blocked': 'This run stopped because that account is switched off by its organization.',
+  // Same refusal text for an admin's block and an ended subscription, and this
+  // line has only the text, so it says what is true of both.
+  'org-blocked': 'This run stopped because Claude Code will not run on that account.',
   'at-limit': 'This run stopped because the account hit its usage limit.',
   workspace: "This run stopped because it would not start in this project's folder.",
   interrupted: 'This run was cut off in the middle.',
+  'model-not-on-plan': "This run stopped because that account's plan does not include the model.",
+  'level-not-offered': 'This run stopped because the model does not offer that thinking level.',
+  network: 'This run stopped because this network would not let it connect securely.',
+  'too-old': `This run stopped because Claude Code on this computer is older than ${Name} needs.`,
+  'api-key': 'This run stopped because Codex is signed in with an API key.',
+  'codex-config': 'This run stopped because Codex could not read its config.toml.',
+  'open-elsewhere': 'This run stopped because the conversation is open in another Codex window.',
   unknown: 'This run stopped before it finished.',
 };
 
@@ -464,27 +745,135 @@ export function runStoppedLine(raw) {
   return RUN_STOPPED[troubleCause(raw)] ?? RUN_STOPPED.unknown;
 }
 
-export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', runs = 1, resetsAt = null } = {}) {
-  const opener = `${engineWord} ${DEAD_RUN_OPENERS[cause] ?? DEAD_RUN_OPENERS.unknown}`;
+// A cause we cannot name still has a likeliest culprit, and it is the agent's
+// plan, not the app (2026-10-19). Engines with no plan to point at get none.
+const UNNAMED_CHECK = {
+  Codex: 'Check that your ChatGPT plan is active at chatgpt.com, or run codex in a terminal to see what it says. ',
+  'Claude Code': 'Check that your Claude plan is active at claude.ai, or run claude in a terminal to see what it says. ',
+};
+
+function dayWords(ms) {
+  return new Date(ms).toLocaleDateString('en-US', { month: 'short', day: 'numeric' });
+}
+
+// What to do before replying to a thread the app has stopped trying on, in the
+// same words `deadRunSentence` uses for each cause. Null when the reply is all.
+function fixBeforeReplying({ cause, engineWord, resetsAt, model, planEnded }) {
+  if (cause === 'signed-out') return 'Sign that account back in.';
+  if (cause === 'no-plan') return `Set up a plan ${SET_UP_A_PLAN}.`;
+  if (cause === 'org-blocked') return 'Only an admin of that Claude workspace can turn it back on.';
+  if (cause === 'subscription-ended') return 'Renew it at claude.ai.';
+  if (cause === 'at-limit') return resetsAt ? `The limit resets at ${resetsAt}.` : 'Wait for the limit to reset.';
+  if (cause === 'too-old') return `To update it, ${UPDATE}.`;
+  if (cause === 'api-key') return 'Run codex login in a terminal to sign in with your ChatGPT plan.';
+  if (cause === 'codex-config') return 'Run codex in a terminal to see the line it points at and fix it.';
+  if (cause === 'open-elsewhere') return 'Close it there.';
+  if (cause === 'model-not-on-plan') {
+    return planEnded
+      ? `That account's ChatGPT subscription ended on ${dayWords(planEnded)}, and the free plan does not include ${model || 'this model'}. Renew it at chatgpt.com, or pick another model for this task.`
+      : 'Pick another model for this task.';
+  }
+  if (cause === 'level-not-offered') return 'Pick another thinking level for this task.';
+  if (cause === 'network') return `If your company uses a proxy or its own certificate, ${NETWORK_FIX} and reopen ${Name}.`;
+  if (cause === 'workspace') return `Open this project's folder in ${engineWord} once and say yes to trusting it.`;
+  if (cause === 'unknown') return UNNAMED_CHECK[engineWord]?.trim() || null;
+  return null;
+}
+
+// NO SENTENCE HERE OFFERS ANOTHER ACCOUNT (w-dac993a554). There used to be an
+// `elsewhere` flag: another signed-in login had room, or had the model, so the
+// line promised the move instead of the wait. Nothing moves work between
+// accounts any more, so a limit is named with the hour it resets and a model no
+// plan includes is answered with another model.
+//
+// `planEnded` is when the account's paid ChatGPT plan ended (main/codex-account.mjs
+// `codexPlanEnded`), which is why its list lacks `model`.
+//
+// `gaveUp` is the app having stopped carrying a reply (`settleDeliveryAndSay`).
+// Nothing restarts the thread until somebody replies or resumes it, so the
+// sentence asks for that and promises nothing of its own.
+// `account` is the login this run was spending, already in words
+// (shared/account-names.mjs). It is null on a Mac with one login, where naming
+// it tells nobody anything, and then every sentence here is the one it has
+// always been. There is no `instead`: nothing takes the task to another login
+// (w-dac993a554), so a limit is named and waited out.
+//
+// `partway` is a run that was picking up a thread an earlier run worked on: it
+// may have done nothing itself, but the task has been started. A cause with no
+// partway words stopped this run before it began, and keeps its own opener.
+//
+// `retryAt` is when the rest ladder starts it again (`restingUntil` in
+// main/supervisor.mjs), named only on the causes that wait for nothing else.
+export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', runs = 1, resetsAt = null, worked: usedATool = false, partway = false, model = null, planEnded = null, gaveUp = false, account = null, retryAt = null, now = Date.now() } = {}) {
+  if (usedATool && !WORKED_OPENERS[cause]) cause = 'unknown';
+  const worked = usedATool || (partway && !!WORKED_OPENERS[cause]);
+  // A LIMIT IS A FACT ABOUT ONE LOGIN, so that is the one cause whose opener
+  // takes the name. The others are about the tool or the task.
+  const limitOpener = cause === 'at-limit' && account
+    ? (worked
+      ? `hit its usage limit on ${account} partway through, so this task is not finished.`
+      : `is at its usage limit on ${account}, so nothing has been done on this task.`)
+    : null;
+  const opener = cause === 'no-plan'
+    ? DEAD_RUN_OPENERS['no-plan']
+    : `${engineWord} ${limitOpener ?? (worked ? WORKED_OPENERS[cause] ?? WORKED_OPENERS.unknown : DEAD_RUN_OPENERS[cause] ?? DEAD_RUN_OPENERS.unknown)}`;
 
   const again = runs > 1 ? ` This has happened ${runs} times on this task.` : '';
 
+  if (gaveUp) {
+    const fix = fixBeforeReplying({ cause, engineWord, resetsAt, model, planEnded });
+    return `${opener}${again} ${fix ? `${fix} Then reply` : 'Reply'} here to start it again.`;
+  }
+
+  const when = retryAt > now ? ` at ${momentWords(retryAt, now)}` : '';
   // THE TIME THE LIMIT PRINTED, when there is one. "when the limit resets"
   // leaves her with a question; "at 6pm" is an answer, and it is the CLI's own
   // word for it rather than anything we worked out.
   const next = cause === 'signed-out'
     ? ' Sign that account back in and it picks straight up.'
+    : cause === 'no-plan'
+      ? ` Set one up ${SET_UP_A_PLAN} and it picks straight up.`
     : cause === 'org-blocked'
       ? ' Only an admin of that Claude workspace can turn it back on.'
+      : cause === 'subscription-ended'
+      ? ' Renew it at claude.ai and it picks straight up.'
       : cause === 'at-limit'
       ? (resetsAt ? ` It starts again on its own at ${resetsAt}.` : ' It starts again on its own when the limit resets.')
+      : cause === 'too-old'
+      ? ` To update it, ${UPDATE}, and it starts again on its own.`
+      : cause === 'api-key'
+      ? ' Run codex login in a terminal to sign in with your ChatGPT plan, and it picks straight up.'
+      : cause === 'codex-config'
+      ? ` Run codex in a terminal to see the line it points at and fix it; ${Name} tries again on its own.`
+      : cause === 'open-elsewhere'
+      ? ` Close it there and ${Name} tries again on its own.`
       : cause === 'interrupted'
-        ? ` ${Name} runs it again on its own.`
-        : ` ${Name} keeps trying, and it will keep failing the same way until this is fixed.`;
+        ? ` ${Name} runs it again on its own${when}.`
+        : cause === 'model-not-on-plan'
+          ? (planEnded
+            ? ` That account's ChatGPT subscription ended on ${dayWords(planEnded)}, and the free plan does not include ${model || 'this model'}. Renew it at chatgpt.com, or pick another model for this task.`
+            : ' Pick another model for this task.')
+        : cause === 'level-not-offered'
+          ? ' Pick another thinking level for this task and it will run.'
+        : cause === 'network'
+          ? ` It will keep failing until this is fixed: if your company uses a proxy or its own certificate, ${NETWORK_FIX} and reopen ${Name}.`
+        : worked
+          ? ` ${Name} tries it again on its own${when}.`
+        : cause === 'workspace'
+          ? ` ${Name} keeps trying, and it will keep failing the same way until this is fixed.`
+        : ` ${UNNAMED_CHECK[engineWord] ?? ''}${Name} tries again on its own${when}.`;
 
   return `${opener}${again}${next}`;
 }
 
+// Whether `deadRunSentence` tells her the app runs the task again by itself.
+// The fresh-work pass keeps a row in the queue on exactly these, so a row is
+// never promised a retry and then read as an answer waiting on her.
+export function deadRunPromisesARetry({ cause = 'unknown', gaveUp = false } = {}) {
+  if (gaveUp) return false;
+  return cause !== 'org-blocked' && cause !== 'level-not-offered' && cause !== 'model-not-on-plan';
+}
+
 /* ------------- a run that finished and still delivered nothing ------------ */
 // WHAT GOES ON HER ROW WHEN THE RUN WAS FINE AND HER ANSWER STILL WENT NOWHERE.
 //
@@ -513,7 +902,43 @@ export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', r
 export function undeliveredAnswerSentence({ engineWord = 'The agent', attempts = 1 } = {}) {
   const n = Math.max(1, Math.trunc(attempts ?? 1));
   const runs = n === 1 ? 'once and finished' : `${n} times and each run finished`;
-  return `Your reply did not reach this task. ${engineWord} ran ${runs} without writing anything back on the row, so ${NAME} has stopped carrying it. Reply again and it goes to a fresh session.`;
+  return `${UNDELIVERED} ${engineWord} ran ${runs} without writing anything back on the row, so ${NAME} has stopped carrying it. Reply again and it goes to a fresh session.`;
+}
+
+const UNDELIVERED = 'Your reply did not reach this task.';
+
+// A THREAD THE APP STOPPED STARTING (`_noteHowTheRunStarted` in
+// main/supervisor.mjs). `tries` is how many times it has tried again on its
+// own since, and `next` when it tries again, null once it has stopped trying.
+const STOPPED_STARTING = `${Name} stopped starting this thread`;
+const clock = (t) => new Date(t).toLocaleTimeString(undefined, { hour: 'numeric', minute: '2-digit' }).toLowerCase().replace(/\s/g, '');
+
+export function stoppedStartingSentence({ starts = 6, minutes = 10, tries = 0, triedAt = null, said = null, next = null } = {}) {
+  const what = tries === 0
+    ? `It was started ${starts} times in ${minutes} minutes, and each run ended before its agent began.`
+    : tries === 1
+      ? `It tried again on its own${triedAt ? ` at ${clock(triedAt)}` : ''}, and that run ended before its agent began too.`
+      : `It tried again on its own ${tries === 2 ? 'twice' : `${tries} times`}, and each run ended before its agent began.`;
+  const last = said ? ` The last one said "${said.slice(0, 300)}".` : '';
+  const then = next ? ` It tries again on its own at ${clock(next)}. Reply here to try again now.` : ' Reply here to try again.';
+  return `${STOPPED_STARTING}. ${what}${last}${then}`;
+}
+
+// THE APP'S OWN WORD THAT A RUN GOT NOWHERE: a dead-run sentence, from a run
+// that used a tool or one that did not, the reply that never landed, or a
+// thread it stopped starting. On a thread carrying a reply, each is written
+// only once nothing will carry the reply on its own, so that thread waits on a
+// person (`gaveUpOnTheAnswer`, renderer/src/list-rules.ts).
+const DEAD_RUN_HALVES = {
+  'at-limit': ['is at its usage limit', 'so nothing has been done on this task.'],
+};
+
+export function saysARunGotNowhere(text) {
+  const s = String(text ?? '');
+  if (!s.trim()) return false;
+  if (deadRunCause(s)) return true;
+  if (Object.values(WORKED_OPENERS).some((opener) => s.includes(opener))) return true;
+  return s.startsWith(UNDELIVERED) || s.startsWith(STOPPED_STARTING);
 }
 
 // WHOSE SENTENCE IS ON THIS ROW, AND WHAT IT SAYS HAPPENED.
@@ -530,12 +955,20 @@ export function undeliveredAnswerSentence({ engineWord = 'The agent', attempts =
 // So a result is asked whose it is. Null means somebody wrote a real answer
 // there and the row is not stranded; a cause means the last word on that row is
 // still the app saying nothing ran.
+//
+// A NAMED LOGIN SITS INSIDE ONE OPENER ("is at its usage limit on
+// alex@acme.com, so nothing has been done"), so that one is read back by its
+// two halves. Without this a row stopped counting as one nothing had run on
+// the moment it said which account was spent.
 export function deadRunCause(text) {
   const s = String(text ?? '');
   if (!s.trim()) return null;
   for (const [cause, opener] of Object.entries(DEAD_RUN_OPENERS)) {
     if (s.includes(opener)) return cause;
   }
+  for (const [cause, halves] of Object.entries(DEAD_RUN_HALVES)) {
+    if (halves.every((half) => s.includes(half))) return cause;
+  }
   return null;
 }
 
@@ -558,10 +991,17 @@ export function deadRunCause(text) {
 // where the shape has no room for a sentence, which is most of them.
 export function causeWord(cause) {
   if (cause === 'signed-out') return 'a signed-out login';
+  if (cause === 'no-plan') return 'no plan to run on';
   if (cause === 'org-blocked') return 'an organization that blocks Claude Code';
+  if (cause === 'subscription-ended') return 'an ended Claude subscription';
   if (cause === 'at-limit') return 'your Claude limit';
   if (cause === 'workspace') return 'a folder Claude will not run in';
   if (cause === 'interrupted') return 'runs getting cut off';
+  if (cause === 'model-not-on-plan') return "a model the account's plan does not include";
+  if (cause === 'level-not-offered') return 'a thinking level its model does not offer';
+  if (cause === 'network') return 'a network that blocks secure connections';
+  if (cause === 'too-old') return 'an out-of-date Claude Code';
+  if (cause === 'open-elsewhere') return 'a conversation open in another Codex window';
   return 'something we cannot name';
 }
 
@@ -571,10 +1011,17 @@ export function causeWord(cause) {
 export function causeWhat(cause, count) {
   const n = Math.max(0, Math.trunc(count ?? 0));
   if (cause === 'signed-out') return `${n} stopped by a signed-out Claude login`;
+  if (cause === 'no-plan') return `${n} waiting on a plan to run on`;
   if (cause === 'org-blocked') return `${n} stopped by an organization that blocks Claude Code`;
+  if (cause === 'subscription-ended') return `${n} stopped by an ended Claude subscription`;
   if (cause === 'at-limit') return `${n} waiting on your Claude limit`;
   if (cause === 'workspace') return `${n} in a folder Claude will not run in`;
   if (cause === 'interrupted') return `${n} cut off mid-run`;
+  if (cause === 'model-not-on-plan') return `${n} asking for a model no signed-in Codex plan includes`;
+  if (cause === 'level-not-offered') return `${n} asking for a thinking level its model does not offer`;
+  if (cause === 'network') return `${n} stopped by a network that blocks secure connections`;
+  if (cause === 'too-old') return `${n} stopped by an out-of-date Claude Code`;
+  if (cause === 'open-elsewhere') return `${n} open in another Codex window`;
   return `${n} stopped for a reason we cannot name`;
 }
 
@@ -582,10 +1029,17 @@ export function causeWhat(cause, count) {
 // comes from the limit line the CLI printed, never from our own clock.
 export function causeNext(cause, resetsAt = null) {
   if (cause === 'signed-out') return 'Type /login in a terminal and they pick straight up.';
+  if (cause === 'no-plan') return `Set one up ${SET_UP_A_PLAN}.`;
   if (cause === 'org-blocked') return 'Ask an admin of that Claude workspace to turn Claude Code back on.';
+  if (cause === 'subscription-ended') return 'Renew it at claude.ai and they pick straight up.';
   if (cause === 'at-limit') return resetsAt ? `They start again on their own at ${resetsAt}.` : 'They start again on their own when it resets.';
   if (cause === 'workspace') return 'Open the folder in Claude once and say yes to trusting it.';
   if (cause === 'interrupted') return `Nothing to do. ${Name} is trying them again.`;
+  if (cause === 'model-not-on-plan') return 'Pick another model on each.';
+  if (cause === 'level-not-offered') return 'Pick another thinking level on each.';
+  if (cause === 'network') return troubleRemedy('network');
+  if (cause === 'too-old') return troubleRemedy('too-old');
+  if (cause === 'open-elsewhere') return 'Close them in the other Codex window.';
   return `${Name} keeps trying on its own.`;
 }
 
@@ -614,7 +1068,7 @@ export function causeBreakdown(rows = [], resetsAt = null) {
       what: causeWhat(cause, count),
       next: causeNext(cause, cause === 'at-limit' ? resetsAt : null),
       act: causeAct(cause),
-      hers: needsHerHands(cause) || cause === 'workspace',
+      hers: needsHerHands(cause) || cause === 'workspace' || cause === 'model-not-on-plan' || cause === 'level-not-offered' || cause === 'network' || cause === 'open-elsewhere',
     }))
     .sort((a, b) => (b.hers - a.hers) || (b.count - a.count) || a.cause.localeCompare(b.cause));
 }