agentbox-app 0.1.13 → 0.1.16

package/main/cloud/usage.mjs

@@ -0,0 +1,76 @@
+// WHAT THE CLOUD RUNS USED, KEPT ON THE MAC (tests/a-cloud-run-records-what-it-really-used).
+//
+// One line per run in ~/.agentbox/cloud-usage.jsonl, beside cloud.json: when,
+// which row, which engine, and what the sandbox measured (cloud/sandbox/usage.mjs).
+// The plan limits are set from these lines, so nothing here is estimated
+// except the cost, and that says so in its name.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// AgentCore Runtime's published rates (us-east-1, 2026-10), per vCPU-hour of
+// CPU actually used and per GB-hour of memory. Runtime v1, which this account
+// runs; v2 is $0.1276 and $0.0169.
+export const AGENTCORE_RATES = { vcpuHour: 0.0895, gbHour: 0.00945 };
+
+export function cloudUsagePath({ home = os.homedir() } = {}) {
+  return path.join(home || os.homedir(), '.agentbox', 'cloud-usage.jsonl');
+}
+
+export function appendCloudUsage({ runId, item, engine, exitCode, usage }, { home, now = Date.now } = {}) {
+  const file = cloudUsagePath({ home });
+  const line = {
+    at: new Date(now()).toISOString(),
+    runId: runId ?? null,
+    item: item ?? null,
+    engine: engine ?? null,
+    exitCode: Number.isInteger(exitCode) ? exitCode : null,
+    wallSeconds: usage?.wallSeconds ?? null,
+    cpuSeconds: usage?.cpuSeconds ?? null,
+    peakMemoryBytes: usage?.peakMemoryBytes ?? null,
+    source: usage?.source ?? null,
+  };
+  // Once per run: a homecoming retried after a failed import reads the same
+  // done.json again.
+  if (line.runId && readCloudUsage({ home }).some((l) => l.runId === line.runId)) return null;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, JSON.stringify(line) + '\n');
+  } catch { /* a record that cannot be written never fails the run */ }
+  return line;
+}
+
+export function readCloudUsage({ home, file = cloudUsagePath({ home }) } = {}) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); } catch { return []; }
+  const out = [];
+  for (const l of text.split('\n')) {
+    if (!l.trim()) continue;
+    try { out.push(JSON.parse(l)); } catch { /* one broken line loses only itself */ }
+  }
+  return out;
+}
+
+// Agent-hours since `since`, and the cost of the runs that measured
+// themselves. Memory is billed on its high-water mark for the whole run, the
+// way Runtime v1 bills it.
+export function summarizeCloudUsage(lines, { since = 0 } = {}) {
+  let runs = 0; let seconds = 0; let measured = 0; let cost = 0;
+  for (const l of lines) {
+    if (Date.parse(l.at) < since) continue;
+    runs += 1;
+    seconds += l.wallSeconds || 0;
+    if (l.wallSeconds && l.cpuSeconds != null && l.peakMemoryBytes != null) {
+      measured += l.wallSeconds;
+      cost += (l.cpuSeconds / 3600) * AGENTCORE_RATES.vcpuHour
+        + (l.peakMemoryBytes / 1024 ** 3) * (l.wallSeconds / 3600) * AGENTCORE_RATES.gbHour;
+    }
+  }
+  return {
+    runs,
+    agentHours: Math.round((seconds / 3600) * 100) / 100,
+    measuredHours: Math.round((measured / 3600) * 100) / 100,
+    estimatedCost: cost,
+    costPerAgentHour: measured ? cost / (measured / 3600) : null,
+  };
+}

package/main/cloud-permission.mjs

@@ -0,0 +1,51 @@
+// THE CLOUD'S OWN PERMISSION MODE, put on a cloud run's arguments. Its own file
+// because the Claude harness and the settings both need it, and the settings
+// already import the harnesses.
+import { CLAUDE_PERMISSION_MODES } from '../shared/work-items.mjs';
+import { isCodexMode } from '../shared/codex-modes.mjs';
+
+const SKIP_FLAGS = ['--dangerously-skip-permissions'];
+
+// Unset, a cloud run does not ask: the sandbox is thrown away after the run,
+// holds no key that can push, and nobody is there to answer a card.
+export const CLOUD_SAME = 'same';
+export const CLOUD_CLAUDE_DEFAULT = 'bypassPermissions';
+export const CLOUD_CODEX_DEFAULT = 'full-access';
+
+/**
+ * The Claude Code mode a cloud run starts in, or null to keep the flag the run
+ * already has: this computer's, or the mode set on the thread itself, which
+ * the cloud must not loosen.
+ */
+export function cloudClaudeMode(setting, threadMode = null) {
+  if (CLAUDE_PERMISSION_MODES.includes(threadMode) || setting === CLOUD_SAME) return null;
+  return CLAUDE_PERMISSION_MODES.includes(setting) ? setting : CLOUD_CLAUDE_DEFAULT;
+}
+
+/** The Codex mode a cloud run starts in, by the same rule. */
+export function cloudCodexMode(setting, threadMode, here) {
+  if (isCodexMode(threadMode)) return threadMode;
+  if (setting === CLOUD_SAME) return here;
+  return isCodexMode(setting) ? setting : CLOUD_CODEX_DEFAULT;
+}
+
+/**
+ * Only the permission flag changes, in place, so nothing else moves. Null
+ * leaves the run on this computer's mode. With no flag to replace it goes
+ * first, where a list flag such as --allowedTools cannot take it as a value.
+ */
+export function cloudPermissionArgs(args, mode) {
+  if (mode == null) return args;
+  if (!CLAUDE_PERMISSION_MODES.includes(mode)) throw new Error(`unknown permission mode: ${mode}`);
+  const out = [];
+  let at = -1;
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = String(args[i]);
+    const flag = arg === '--permission-mode' || arg.startsWith('--permission-mode=') || SKIP_FLAGS.includes(arg);
+    if (!flag) { out.push(args[i]); continue; }
+    if (at < 0) at = out.length;
+    if (arg === '--permission-mode') i += 1;
+  }
+  out.splice(at < 0 ? 0 : at, 0, '--permission-mode', mode);
+  return out;
+}

package/main/codex-account.mjs

@@ -113,6 +113,71 @@ export function codexAccount(home = null, { file = null } = {}) {
   return { email, name, plan, planNamed: planIsNamed(chatgpt?.chatgpt_plan_type), mode, accountId };
 }
 
+/**
+ * WHEN THIS LOGIN'S PAID CHATGPT PLAN ENDED, in ms, or null.
+ *
+ * A lapsed plan reads `chatgpt_plan_type: "free"` and keeps the old
+ * subscription's `chatgpt_subscription_active_until`. Only that pair is read as
+ * an ending: a paid type with a past date is a token minted before a renewal,
+ * and a free login that never paid has no date.
+ */
+export function codexPlanEnded(home = null, { file = null, now = Date.now() } = {}) {
+  let auth = null;
+  try { auth = JSON.parse(fs.readFileSync(file ?? codexAuthFile(home), 'utf8')); } catch { return null; }
+  const chatgpt = claims(auth?.tokens?.id_token)?.[AUTH_CLAIM];
+  if (String(chatgpt?.chatgpt_plan_type ?? '').trim().toLowerCase() !== 'free') return null;
+  const until = Date.parse(chatgpt?.chatgpt_subscription_active_until ?? '');
+  return Number.isFinite(until) && until <= now ? until : null;
+}
+
+/**
+ * WHETHER THE FREE PLAN IS WHY CODEX OFFERS FEW MODELS: `{ endedAt }` when every
+ * one of these logins reads Free, with the latest paid plan's end or null, and
+ * null when any login is paid or cannot say.
+ */
+export function codexFreePlan(homes, { now = Date.now() } = {}) {
+  if (!homes.length || !homes.every((h) => codexAccount(h)?.plan === PLANS.free)) return null;
+  const ended = homes.map((h) => codexPlanEnded(h, { now })).filter((t) => t != null);
+  return { endedAt: ended.length ? Math.max(...ended) : null };
+}
+
+/**
+ * WHAT KIND OF LOGIN A CODEX HOME HOLDS: 'chatgpt' (a plan), 'apikey' (a key,
+ * metered per call), or null when it cannot say.
+ *
+ * Codex's own reading: `auth_mode` when the file has one, and an older file
+ * with no mode is a key when it carries a key and no tokens. A ChatGPT login
+ * with a key left beside its tokens is still a ChatGPT login; the mode decides.
+ */
+export function codexLoginMode(home = null, { file = null } = {}) {
+  let auth = null;
+  try { auth = JSON.parse(fs.readFileSync(file ?? codexAuthFile(home), 'utf8')); } catch { return null; }
+  if (!auth || typeof auth !== 'object') return null;
+  const mode = typeof auth.auth_mode === 'string' ? auth.auth_mode.trim().toLowerCase().replace(/[^a-z]/g, '') : '';
+  if (mode) return mode === 'apikey' ? 'apikey' : mode.startsWith('chatgpt') ? 'chatgpt' : mode;
+  if (auth.tokens && typeof auth.tokens === 'object') return 'chatgpt';
+  return typeof auth.OPENAI_API_KEY === 'string' && auth.OPENAI_API_KEY ? 'apikey' : null;
+}
+
+/**
+ * WHY A WORKER MAY NOT RUN ON THIS CODEX LOGIN, OR NULL WHEN IT MAY.
+ *
+ * Workers run on a subscription and never on a key, and the worker scrub
+ * keeps OPENAI_API_KEY out of their environment for it. But `codex login
+ * --with-api-key` keeps the key in auth.json, which Codex reads for itself,
+ * past the scrub: measured 2026-10-15 with codex-cli 0.160.0 on a home laid
+ * out that way (the verify skill's `codex-api-key-login` setup), every request
+ * a worker sent was signed with the key, and the task was answered as though
+ * nothing were wrong. There is no plan in such a home to fall back on, so the
+ * run is refused, in words shared/spawn-trouble.mjs files as 'api-key'. The
+ * key is never in the sentence.
+ */
+export function codexKeyRefusal(home = null, opts = {}) {
+  return codexLoginMode(home, opts) === 'apikey'
+    ? 'Codex is signed in with an API key, which bills every call to that key. Workers only run on a ChatGPT plan: run codex login in a terminal to sign in with ChatGPT.'
+    : null;
+}
+
 /**
  * A FOLDER FOR THE NEXT CODEX LOGIN, MADE BEFORE ANYTHING IS ASKED TO USE IT.
  *
@@ -137,6 +202,19 @@ export function makeCodexHome({ home = os.homedir(), mkdir = fs.mkdirSync, exist
   throw new Error('There are already a lot of Codex folders in your home directory.');
 }
 
+/**
+ * codex-cli refuses a `CODEX_HOME` that does not exist rather than making it,
+ *  and exits 1 before anything else happens; an empty folder that exists is
+ *  fine. Every spawn here names `CODEX_HOME`, so each one goes through this
+ *  first (tests/codex-never-starts-on-a-home-that-is-not-there).
+ *
+ * @returns the home it was given, so it can be used inline at a spawn.
+ */
+export function ensureCodexHome(home, { mkdir = fs.mkdirSync } = {}) {
+  if (home) { try { mkdir(home, { recursive: true }); } catch { /* codex's own message about the folder is the better one */ } }
+  return home;
+}
+
 /**
  * The one line that signs a new account in, for the terminal to run. The home
  *  is spelled out rather than left to the shell, because `~` inside a variable