ccdeck 3.29.10 → 3.30.0

package/src/server/clear-route.mjs

@@ -0,0 +1,191 @@
+// POST /api/clear, the deck's one irreversible action: the ring emptied, the
+// log and its archive emptied when this deck is the one writing them, and the
+// `__clear` marker that tells every open page to forget what it drew.
+//
+// And GET /api/clear, the question the dialog asks before the press, which is
+// answered from the same logSharing the press is gated on.
+//
+// Both lived in src/server/index.mjs — the press after the SSE resume, the
+// question in the route table. The press empties the ring through
+// event-ring.mjs, drops the output watch's and the enrichment's emit gates, and
+// sends the marker through pushEvent. Both bodies are unchanged.
+import { PRODUCT } from "./brand.mjs";
+import { send } from "./http-io.mjs";
+// The ring the press empties — see event-ring.mjs.
+import { clearEventBuffer } from "./event-ring.mjs";
+// The one door every event comes through, the marker's included — see
+// event-pipeline.mjs.
+import { pushEvent } from "./event-pipeline.mjs";
+// Which deck owns the log, and so may empty it — see event-log.mjs.
+import { logSharing } from "./event-log.mjs";
+import { emptyLog } from "./log-writer.mjs";
+import { outputWatch } from "./session-tracking.mjs";
+import { clearEnrichmentGates } from "./session-enrichment.mjs";
+
+/**
+ * GET /api/clear — what a POST to this path would do, and to whose log.
+ *
+ * Asked by the confirmation dialog as it opens, on demand rather than on a
+ * timer, for the reason /api/system/processes is: the answer costs a directory
+ * read, changes only when a deck starts or stops, and matters at exactly one
+ * moment. See logSharing.
+ */
+export function handleClearPreview(res) {
+  return logSharing().then(s => send(res, 200, {
+    ok: true, path: s.path, decks: s.decks, mine: s.mine,
+    owner: s.owner ? { port: s.owner.port } : null,
+  }));
+}
+
+/**
+ * The deck's one irreversible action: empty the ring, and empty the log — both
+ * of its generations, the live file and the archive rotation leaves beside it —
+ * but only the log this deck is the one writing.
+ *
+ * The gate is the whole of #698. `truncate(persistPath, 0)` ran from whichever
+ * deck was asked, and `persistPath` is one file several decks share by default,
+ * so Clear on a deck scoped to a single tree deleted the machine-wide deck's
+ * entire history while its canvas showed no change at all. Ownership is
+ * electWriters, the election that already decides which of those decks appends a
+ * line, so nothing new gets to disagree with it: the deck that fills the file is
+ * the deck that may empty it, and a deck that writes nothing to it cannot
+ * destroy it. See logSharing.
+ *
+ * A deck that does not own the log still clears its own canvas — that is what
+ * the user pressed, and the ring is this deck's alone — and says which deck's
+ * file it declined to touch, so the answer is a fact the UI can show rather than
+ * a silent partial success. The dialog asked `GET /api/clear` before the press
+ * and has already said the same thing in words.
+ *
+ * The `__clear` marker is broadcast and NOT persisted. It never belonged on
+ * disk: replaying an empty log and then a marker that empties it produces the
+ * same empty state, and appending it was how a deck that writes nothing else to
+ * the shared file still left 134 bytes in it — the reproduction's whole
+ * remainder. `{ persist: false }` is the same flag the hook sets on the decks it
+ * did not elect.
+ */
+export async function handleClear(res) {
+  const sharing = await logSharing();
+  const mineToEmpty = Boolean(sharing.path && sharing.mine);
+  // THE PRESS IS ONE SYNCHRONOUS MOMENT, from the ring being emptied to the
+  // marker being pushed, and the log's turn on the append queue is taken
+  // inside it. Nothing from here awaits until the marker is out, so no event
+  // can be pushed in the middle: every event is on one side of the press, and
+  // it is the same side for the board, the ring and the file.
+  //
+  //   * Pushed before it: out of the ring by clearEventBuffer, numbered below
+  //     the marker so the reducer forgets it, and queued before the truncate —
+  //     written, then erased.
+  //   * Pushed after it: numbered above the marker so the board keeps it, and
+  //     queued AFTER the truncate, so its write cannot begin until the file has
+  //     been emptied. That is why a Clear cannot take an event posted after it
+  //     along with it: the chain in log-writer.mjs is the only way this process
+  //     writes the log, and it starts each step only when the one before it has
+  //     settled.
+  //
+  // Both halves were broken in turn. #1005: the truncate consulted the queue in
+  // neither direction, so the queue drained PRE-CLEAR lines into the freshly
+  // emptied file — 564 bytes and three events of a cleared session, 2.5s after
+  // a Clear that answered `{"log":"cleared"}`. Its fix waited for the queue and
+  // then truncated beside it, but the wait was for the queue as it stood when
+  // the wait began, and the session went on posting through it: MEASURED
+  // (#1130), five runs, 4, 5, 3, 3 and 2 events the Clear had taken off the
+  // board were in the file a restart replays. See emptyLog.
+  //
+  // This is #698's residue by a different route, and it survives the ownership
+  // gate that fixed #698 precisely because it happens on the deck that DOES own
+  // the file.
+  //
+  // Not `events.length = 0`: the ring is measured by a running total now, and
+  // emptying the array without the total leaves a debt that never clears. See
+  // clearEventBuffer.
+  clearEventBuffer();
+  // THE ARCHIVE GOES WITH IT. Since #1062 the replay reads events.jsonl.1
+  // whenever the live log cannot fill the ring, and a live log a Clear has just
+  // emptied never can — so a Clear on a log that had rotated once came back,
+  // whole, at the next boot. MEASURED (#1130): three events in the archive and
+  // one in the live log, `/api/clear` answering `log: "cleared"` over a live
+  // file of 0 bytes, and replayLog on the same path returning the three
+  // archived sessions.
+  //
+  // Removed, rather than fenced off by a `__clear` line the replay stops at,
+  // and the confirmation is why: it tells the user the history is gone and
+  // cannot be undone, and a marker would leave a whole rotated generation of it
+  // on disk behind a line asking readers not to look — readable by anything
+  // else that opens the file. It would also put back on disk the line #698
+  // took off it on purpose, and it would need a stopping rule the forwards
+  // replay does not have: that branch reads the archive FIRST, so it would push
+  // the cleared generation into the ring before it ever met the line saying to
+  // discard it. The ownership gate is the truncate's, and it covers the archive
+  // exactly: only the deck that writes a log may rotate it (#1062), so only
+  // that deck ever made its archive.
+  //
+  // Nothing else of the log's bookkeeping is reset, deliberately.
+  // `failedLines` / `failedChars` count what the DISK refused since this deck
+  // started, which a Clear does not change — `/api/health` documents them that
+  // way, and zeroing them would hide a volume that is still failing — and an
+  // open failure episode ends only on a line that lands, the one evidence that
+  // the condition is over, which a Clear is not. The rotation's byte count is
+  // a trigger for a `stat`, not a size: over-counting after a truncate costs at
+  // most one early look, which finds a small file and resets it. And a
+  // rotation running at the same moment needs nothing from here; emptyLog says
+  // why the order inside the turn is enough.
+  const emptyOutcome = {};
+  const emptied = mineToEmpty ? emptyLog(sharing.path, [sharing.path + ".1"], undefined, emptyOutcome) : null;
+  // Drop the caches that gate an emit on "has this changed", because the
+  // client is about to forget what they are comparing against: __clear makes
+  // the reducer return a fresh state, so every session's name and every
+  // subagent's model label go with it. maybeResolveSessionName then computes
+  // the same signature, takes its early return, and emits nothing — so the
+  // card falls back to cwd/prompt for the rest of that session while the
+  // server is sitting on the name.
+  //
+  // The root model survives without help because pushEvent stamps
+  // `raw.model` on every payload; there is no equivalent stamp for the name
+  // or for a subagent's model, which is why those two are listed and the
+  // rest of the per-session state is not.
+  //
+  // The rule, for the next cache that gates an emit: anything answering
+  // "has this changed" has to appear in BOTH places that mean the client no
+  // longer has it — here (clearEnrichmentGates), and in forgetSession
+  // (forgetEnrichment).
+  outputWatch.clear();
+  clearEnrichmentGates();
+  pushEvent({ hook_event_name: "__clear", cwd: "" }, "internal", { persist: false });
+  // The end of the press. Awaited, where the truncate used to be fired and
+  // forgotten, so the answer does not go out before the file has actually
+  // reached zero — and bounded by emptyLog, so a disk that does not come back
+  // in time still gets an answer, with the turn left on the chain in order.
+  if (emptied) await emptied;
+  // WHAT THE FILE ACTUALLY DID (#1140). This answered "cleared" for any log this
+  // deck owns, whatever the truncate had done: emptyLog keeps the queue moving
+  // by swallowing its error, and nothing read it back, so on a read-only volume
+  // the page was told the history was gone and the next boot replayed all of
+  // it. The canvas IS clear either way — the ring was emptied above — so this
+  // stays `ok`, and says which half did not happen, here and in the terminal.
+  // A turn still on the chain at the deadline has no error yet and keeps the
+  // answer it always had.
+  //
+  // AND THE ARCHIVE, for the same reason: one that survives a Clear is the whole
+  // history again at the next boot, because the replay falls back to it once the
+  // live log is empty (#1130). Either half failing makes the answer "failed", and
+  // each says which it was.
+  const truncateFailed = mineToEmpty && emptyOutcome.error ? emptyOutcome.error : null;
+  const archiveFailed = mineToEmpty && emptyOutcome.archiveError ? emptyOutcome.archiveError : null;
+  const failed = truncateFailed ?? archiveFailed;
+  if (truncateFailed) {
+    console.error(`${PRODUCT}: Clear could not empty the event log ${sharing.path} (${truncateFailed.code ?? truncateFailed.message}) — the canvas is clear, but that history will come back at the next boot`);
+  }
+  if (archiveFailed) {
+    console.error(`${PRODUCT}: Clear could not remove the event log's archive ${sharing.path}.1 (${archiveFailed.code ?? archiveFailed.message}) — the canvas is clear, but that history will come back at the next boot`);
+  }
+  return send(res, 200, {
+    ok: true,
+    log: !sharing.path ? "none" : sharing.mine ? (failed ? "failed" : "cleared") : "kept",
+    ...(failed ? { error: failed.code ?? "EIO" } : {}),
+    path: sharing.path,
+    decks: sharing.decks,
+    mine: sharing.mine,
+    owner: sharing.owner ? { port: sharing.owner.port } : null,
+  });
+}

package/src/server/codex-auth.mjs

@@ -15,7 +15,7 @@
 import { readFile, chmod, unlink } from "node:fs/promises";
 import { join } from "node:path";
 import { CODEX_HOME } from "./codex-dir.mjs";
-import { createTemp, renameWithRetry, resolveWriteTarget } from "./installer.mjs";
+import { createTemp, renameWithRetry, resolveWriteTarget } from "./atomic-write.mjs";
 import { PRODUCT } from "./brand.mjs";
 
 // This file used to resolve CODEX_HOME itself, as `process.env.CODEX_HOME ??
@@ -150,13 +150,13 @@ async function readAuthFile() {
  * Resolves symlinks first — `~/.codex/auth.json` is often a link into a
  * dotfiles repo or an encrypted volume, and renaming onto the link would
  * replace it with a regular file, quietly detaching the user's setup. That
- * resolution is the installer's resolveWriteTarget rather than a bare realpath
+ * resolution is atomic-write.mjs's resolveWriteTarget rather than a bare realpath
  * here, because settings.json needed the identical rule (#673) and a rule
  * written twice is a rule that drifts: the shared one also follows a DANGLING
  * link to the file it names, which a realpath cannot answer at all and which is
  * exactly the state a dotfiles repo is in before its first apply.
  *
- * The temp file comes from the installer's createTemp, which numbers every
+ * The temp file comes from atomic-write.mjs's createTemp, which numbers every
  * write and creates it with O_EXCL, rather than from a name built out of the
  * pid alone. A pid names a process, not a write, so that name was one file
  * shared by every write this process makes, and the open that filled it
@@ -171,7 +171,7 @@ async function readAuthFile() {
  * which is also what makes the 0600 binding from the very first byte rather
  * than whatever the file it inherited happened to allow.
  *
- * The rename is the installer's retrying one because Windows fails it outright
+ * The rename is atomic-write.mjs's retrying one because Windows fails it outright
  * with EPERM/EBUSY while another process holds auth.json open, and a virus
  * scanner, the search indexer or the Codex CLI itself does exactly that for a
  * few milliseconds at a time. Everywhere else that costs a re-download; here

package/src/server/codex-dir.mjs

@@ -1,5 +1,6 @@
 // Where OpenAI Codex lives on this machine: its home directory, its rollout
-// tree, and the walk over that tree — the Codex-side mirror of claude-dir.mjs.
+// tree, the walk over that tree and the session id a rollout's file name
+// carries — the Codex-side mirror of claude-dir.mjs.
 //
 // CODEX_HOME relocates ~/.codex wholesale, exactly as CLAUDE_CONFIG_DIR does on
 // the Claude side, and five modules used to answer the question for themselves
@@ -36,7 +37,7 @@
 // right way round rather than merely the majority.
 import { readdir } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, posix as posixPath, win32 as winPath } from "node:path";
+import { basename, join, posix as posixPath, win32 as winPath } from "node:path";
 
 /**
  * Absolute path of the Codex home directory: $CODEX_HOME or ~/.codex.
@@ -125,12 +126,13 @@ export const STOP = Symbol("stop-rollout-walk");
  * and the names inside it to `onDay(dir, files)`.
  *
  * Three callers walked this tree with the same four nested readdir-and-continue
- * blocks and differed only in the last few lines: find the file carrying a given
- * session id (index.mjs), collect everything in the newest two day directories
- * (index.mjs again, for the watcher), and collect everything whose filename
- * timestamp falls inside a rolling window (codex-usage.mjs). The walk is the
- * part that has to agree — a deck that tails one set of files and reports usage
- * from another is reporting on a session it is not showing.
+ * blocks and differed only in the last few lines: find the file carrying a
+ * given session id (now codex-enrichment.mjs), collect everything in the newest
+ * two day directories (codex-watch.mjs, for the watcher), and collect
+ * everything whose filename timestamp falls inside a rolling window
+ * (codex-usage.mjs). The walk is the part that has to agree — a deck that tails
+ * one set of files and reports usage from another is reporting on a session it
+ * is not showing.
  *
  * EVERY LEVEL SWALLOWS ITS OWN ERROR, which is deliberate rather than lazy. The
  * tree is written by another process while this one reads it: a day directory
@@ -169,3 +171,45 @@ export async function walkRolloutDays(onDay, { sessionsDir = CODEX_SESSIONS_DIR,
     }
   }
 }
+
+// This lived in codex-watch.mjs, beside the header read it is the fallback for.
+// It is the rule for the names of the files in the tree above, which the
+// rollout lookup in codex-enrichment.mjs matches session ids against too, so it
+// lives here, where either can import it without importing the watcher.
+/**
+ * The session id a rollout's own file name carries, or null.
+ *
+ * Codex names every rollout `rollout-<YYYY-MM-DDTHH-MM-SS>-<uuid>.jsonl` —
+ * codex-usage.mjs reads the timestamp half as parseRolloutTime — and the uuid
+ * is the id `session_meta.payload.id` states. findCodexRolloutPath already leans
+ * on that, matching a session id against file names, so the name is the
+ * fallback when the header stops saying it (#996). A compressed `.jsonl.zst`
+ * is not matched: this reader never opens one.
+ */
+export function sidFromRolloutName(path) {
+  const m = /-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i.exec(basename(String(path ?? "")));
+  return m ? m[1] : null;
+}
+
+/**
+ * The id segment of a rollout's file name, or null for a name not built the way
+ * Codex builds one.
+ *
+ * Codex writes `rollout-<YYYY-MM-DDTHH-MM-SS>-<id>.jsonl`: a fixed-width
+ * timestamp, then the session's id, then the extension. So the id is exactly
+ * what lies between the timestamp's trailing `-` and `.jsonl`, and a session's
+ * rollout is the file whose segment EQUALS its id — the test findCodexRolloutPath
+ * in codex-enrichment.mjs finds a rollout by (#1653). It used to ask whether the
+ * name contained the id anywhere, which a prefix of another session's id, its
+ * last group or a piece of the timestamp all pass.
+ *
+ * Deliberately not sidFromRolloutName above, which answers a different
+ * question: what uuid a name ends in, for a watcher that has no other id to go
+ * on. This one is handed the id and asks only whether the name is built around
+ * it, so it asks nothing of the id's shape — the lookup never has — and for
+ * every name Codex writes the two agree.
+ */
+export function rolloutNameId(name) {
+  const m = /^rollout-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-(.+)\.jsonl$/.exec(String(name ?? ""));
+  return m ? m[1] : null;
+}

package/src/server/codex-enrichment.mjs

@@ -0,0 +1,310 @@
+// What the deck learns about a Codex session that its hook payloads never say:
+// the token spend, the model and the context window, read off the session's
+// rollout — found by id under $CODEX_HOME/sessions — and sent on as synthetic
+// events.
+//
+// This lived in src/server/codex-watch.mjs, above the rollout watcher, and
+// shared nothing with it but the tree they both walk and the chunked reader.
+// The watcher tails the rollouts for the events themselves; this reads one for
+// what the events of a hook-delivered Codex session leave out. pushEvent
+// (event-pipeline.mjs) hands every live event to maybeResolveCodex, and
+// session-tracking.mjs forgets a session through forgetCodexSession. The
+// bodies are unchanged.
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+import { STOP, rolloutNameId, walkRolloutDays } from "./codex-dir.mjs";
+// The per-session model and approval policy the translation remembers, which
+// forgetCodexSession drops with the rest, and the record shapes readCodexRollout
+// reads a rollout's lines by, the ones the translation reads — see
+// codex-translate.mjs.
+import {
+  codexSessionApproval, codexSessionModel,
+  responseItemModel, sessionMeta, taskStartedWindow, tokenCountInfo,
+} from "./codex-translate.mjs";
+// The bounded chunk reads the Claude transcripts use — see jsonl-chunks.mjs.
+import { readByteRange } from "./jsonl-chunks.mjs";
+// event-pipeline.mjs's pushEvent, reached without importing it — see
+// event-sink.mjs.
+import { pushEvent } from "./event-sink.mjs";
+// One read per session at a time, and none inside the window — see
+// session-read-gate.mjs.
+import { sessionReadGate } from "./session-read-gate.mjs";
+
+// ─── Codex transcript enrichment ──────────────────────────────────────────
+// Codex CLI hook payloads carry `session_id` but no transcript path. Sessions
+// are persisted to ~/.codex/sessions/YYYY/MM/DD/rollout-<timestamp>-<sid>.jsonl
+// with one JSON object per line: {type, payload}. Token usage shows up in
+//   {type:"event_msg", payload:{type:"token_count",
+//     info:{total_token_usage:{input_tokens, cached_input_tokens,
+//                              output_tokens, reasoning_output_tokens,
+//                              total_tokens}}}}
+// We resolve the rollout path lazily (cache sid→path), then read the tail
+// for usage + model. CODEX_HOME overrides ~/.codex, and codex-dir.mjs owns that
+// rule for every module on the Codex side — this one used to spell it inline,
+// which is how five modules ended up with three spellings of it (#375).
+// sid -> the rollout's path, or, once a walk of the whole tree came back without
+// one, the moment that walk began. See findCodexRolloutPath for why a miss is
+// kept (#992), and why only for CODEX_MISS_TTL_MS (#1134).
+const codexRolloutPathBySid = new Map();
+const CODEX_READ_THROTTLE_MS = 2500;
+const codexUsageReads = sessionReadGate(CODEX_READ_THROTTLE_MS);
+// How many of the newest day directories a lookup reads when it is not owed
+// the whole tree: the bound listRecentCodexRollouts keeps for the watcher.
+const CODEX_RECENT_DAY_DIRS = 2;
+// How long a miss from the whole tree is believed before its id is owed one
+// more walk of it. See findCodexRolloutPath for why ten minutes.
+const CODEX_MISS_TTL_MS = 10 * 60 * 1000;
+// True while one lookup is walking the whole tree. One at a time; see below.
+let codexWholeTreeWalk = false;
+
+/**
+ * Where is this session's rollout, if it is anywhere under this tree?
+ *
+ * WHAT WAS WRONG (#992). A hit was kept and a miss was not, and the walk that
+ * answers a miss is the whole tree: one readdir per year, per month and per day
+ * under $CODEX_HOME/sessions, which only a hit ends early. So an id with no
+ * rollout here paid for that walk again on every pass maybeResolveCodex's
+ * 2.5-second throttle let through, for as long as its hooks kept firing. A Codex
+ * hook left over from an older install, for a session whose rollout lives
+ * under another CODEX_HOME, is enough. The id also arrives on `/api/event`,
+ * which takes no credential and throttles per id, so a local process could post
+ * a few hundred fresh ids and have every one of them walk every directory at
+ * once. Both were measured in codex-unresolved-session-walk-992.test.ts, over a
+ * tree holding one year of history. The same unresolvable id, posted twice one
+ * throttle window apart, read all 37 of that year's directories both times, and
+ * six fresh ids posted together had six walks of it in flight at once.
+ *
+ * THE FIRST LOOKUP STILL WALKS THE WHOLE TREE, newest first, as it always did.
+ * A session resumed from last month appends to last month's rollout, and one
+ * that has been running for three days has dropped out of the newest two
+ * directories. Bounding the first walk the way the watcher's listing is bounded
+ * would find neither, and their usage would never show.
+ *
+ * A MISS FROM THE WHOLE TREE IS KEPT, as the moment that walk began, and every
+ * later lookup for that id reads only the newest two day directories. Those are
+ * the only place a rollout written after the walk can land, because Codex names
+ * a file for the moment it creates it, and they are the bound
+ * listRecentCodexRollouts already trusts for live sessions. So a hook that
+ * fires a moment before its rollout is on disk is still answered on a later
+ * pass, and an id nothing will ever carry costs about five readdirs a pass
+ * instead of the whole history. One caveat: walkRolloutDays swallows every
+ * error it meets, so a walk that could not read a directory still counts as
+ * having looked there. That is the one way a wrong miss gets kept.
+ *
+ * BUT NOT FOREVER (#1134). The newest two directories are where a rollout
+ * written after the walk lands, and they do not stay the newest two. A session
+ * whose first hook fired before its rollout existed, and whose next hook came
+ * after two newer day directories had appeared — a `codex resume` two days
+ * later — had its rollout in the third-newest directory, behind a miss that
+ * only forgetSession or a restart would ever clear. Its usage never showed,
+ * where the tree before #1111 found it; codex-kept-miss-expires-1134.test.ts
+ * has the measurement.
+ *
+ * So a kept miss is believed for CODEX_MISS_TTL_MS, and the first lookup after
+ * that is owed one more whole walk, on the same one-at-a-time terms as the
+ * first. Ten minutes closes the hole outright. A rollout drops out of the newest
+ * two directories only once two later calendar days have begun, which is never
+ * less than about a day after it was written (23 hours across a DST change), so
+ * by then every miss that could be hiding it has expired and the next lookup
+ * walks to it. It also keeps #992 fixed: an id nothing carries walks the whole
+ * tree once in ten minutes where it used to walk it every 2.5-second throttle
+ * window, 240 times as often, and reads its five directories in between. And
+ * the caveat above now costs a session ten minutes of usage rather than the
+ * rest of the process's life. It is the same ten minutes CODEX_STATE_TTL_MS
+ * keeps a rollout's cursor for, the other bound on this side that leans on the
+ * two-directory window. A clock that has gone backwards leaves a miss's age
+ * unknown, and such a miss is treated as expired: it costs one walk, where
+ * believing it would reopen the hole for however far the clock went back.
+ *
+ * AND ONE WHOLE-TREE WALK AT A TIME. Keeping the miss handles an id that comes
+ * back; it does nothing for a caller that sends a new one every time. So a
+ * lookup that is owed the whole tree while another lookup is walking it reads
+ * the newest two directories instead, keeps nothing, and gets its full walk on
+ * a later pass. A burst of fresh ids costs one walk of the history plus a few
+ * readdirs each, not one walk each, all at once.
+ *
+ * The map is bounded as it was: forgetSession evicts it with every other
+ * per-session cache, and a number is smaller than the path it stands in for.
+ */
+async function findCodexRolloutPath(sid) {
+  const cached = codexRolloutPathBySid.get(sid);
+  if (typeof cached === "string") return cached;
+  // Owed the whole tree: never looked for yet, or the whole tree's last miss is
+  // no longer believed — and nobody else is walking it.
+  const startedAt = Date.now();
+  const age = typeof cached === "number" ? startedAt - cached : -1;
+  const missHolds = age >= 0 && age < CODEX_MISS_TTL_MS;
+  const whole = !missHolds && !codexWholeTreeWalk;
+  if (whole) codexWholeTreeWalk = true;
+  // Walk year → month → day → files, newest first. Codex names the file for the
+  // sid (rollout-<timestamp>-<sid>.jsonl) so a directory-scoped match is enough.
+  // The walk itself lives in codex-dir.mjs, shared with the watcher's listing
+  // in codex-watch.mjs and with codex-usage.mjs, so all three read one tree the
+  // same way.
+  //
+  // The name's WHOLE id segment, never a substring of the name (#1653).
+  // `includes` took the first file whose name contained the id anywhere, so an
+  // id shorter than a whole one — a prefix of another session's id, its last
+  // group, a piece of the timestamp — found that other session's rollout, and
+  // the hit below kept it: the short id's card showed another session's usage,
+  // model and window from then on. See rolloutNameId in codex-dir.mjs.
+  let found = null;
+  let dayDirs = 0;
+  try {
+    await walkRolloutDays((dayDir, files) => {
+      const hit = files.find(f => rolloutNameId(f) === sid);
+      if (hit) {
+        found = join(dayDir, hit);
+        return STOP;
+      }
+      if (!whole && ++dayDirs >= CODEX_RECENT_DAY_DIRS) return STOP;
+    });
+  } finally {
+    if (whole) codexWholeTreeWalk = false;
+  }
+  // A hit is kept, as it always was. A miss is kept only when it is the whole
+  // tree's answer — a miss in the newest two directories says nothing about the
+  // rest of them — and it is kept as the moment that walk began, which is when
+  // it read the directories a rollout written since would be in.
+  if (found) codexRolloutPathBySid.set(sid, found);
+  else if (whole) codexRolloutPathBySid.set(sid, startedAt);
+  return found;
+}
+
+/**
+ * The head and the tail of a Codex rollout, never the middle.
+ *
+ * WHAT THIS FIXES (#792). It called itself a tail-read and read the whole file:
+ * `Buffer.alloc(s.size)` in one go, then `split` and `JSON.parse` over every
+ * line. Measured against this machine's own largest rollout — 44.4 MB — that is
+ * 181ms to read and decode, 95ms of SYNCHRONOUS parsing blocking the event
+ * loop, and 185 MB of resident memory for the buffer, the string and the split
+ * array together. Past about 512 MB `toString` throws outright, the catch
+ * answers null, and the deck reports no Codex usage or model for the rest of
+ * its life.
+ *
+ * It is reached from `/api/event`, which is in OPEN_MUTATIONS — no token, no
+ * browser identity — so any local process can ask for it, and the per-session
+ * throttle is keyed on `sid`, which means distinct sid strings each get their
+ * own budget. That note's own rule is the one this violated: the deck's memory
+ * "cannot be a function of anything but the two constants named here".
+ *
+ * WHY HEAD AND TAIL RATHER THAN A CURSOR. The four fields do not live in one
+ * place. `session_meta` is the FIRST record — cwd, sometimes the model — while
+ * the last `token_count`, the last `task_started` and the newest
+ * `response_item` model are all at the END. A forward cursor would have to keep
+ * the head's answers across polls, which is a second cache to invalidate; two
+ * bounded reads answer the same question with no state at all.
+ *
+ * A file smaller than both windows is read once, so nothing changes for the
+ * ordinary rollout — the median here is well under a megabyte.
+ */
+const CODEX_HEAD_BYTES = 256 * 1024;
+const CODEX_TAIL_BYTES = 2 * 1024 * 1024;
+
+// Exported for the suite, which is the only way to drive the head-and-tail
+// branch: building a rollout larger than both windows is cheap, and reaching
+// this function through /api/event would mean a server, a discovery file and a
+// throttle that all have nothing to do with what is being measured.
+export async function readCodexRollout(path) {
+  try {
+    const s = await stat(path);
+    if (s.size === 0) return null;
+    let text;
+    if (s.size <= CODEX_HEAD_BYTES + CODEX_TAIL_BYTES) {
+      text = await readByteRange(path, 0, s.size);
+    } else {
+      // A newline between them so the two windows cannot splice a half line
+      // from the head onto a half line from the tail and hand the parser a
+      // record that never existed. The tail's own first line is partial by
+      // construction and is dropped the same way: `JSON.parse` refuses it and
+      // the loop below skips it.
+      const head = await readByteRange(path, 0, CODEX_HEAD_BYTES);
+      const tail = await readByteRange(path, s.size - CODEX_TAIL_BYTES, s.size);
+      text = `${head}\n${tail}`;
+    }
+    let lastUsage = null;
+    let model = null;
+    let contextWindow = null;
+    let cwd = null;
+    for (const line of text.split("\n")) {
+      if (!line) continue;
+      let obj;
+      try { obj = JSON.parse(line); } catch { continue; }
+      // One record is one of these at most: each asks the record's own type.
+      const meta = sessionMeta(obj);
+      if (meta) {
+        if (typeof meta.cwd === "string") cwd = meta.cwd;
+        // session_meta sometimes carries the model in newer Codex versions.
+        if (typeof meta.model === "string") model = meta.model;
+      }
+      const usage = tokenCountInfo(obj)?.total_token_usage;
+      if (usage) lastUsage = usage;
+      const window = taskStartedWindow(obj);
+      if (window !== null) contextWindow = window;
+      // Fallback model source — response items carry the model id.
+      const itemModel = responseItemModel(obj);
+      if (itemModel !== null) model = itemModel;
+    }
+    if (!lastUsage && !model && !contextWindow) return null;
+    return { usage: lastUsage, model, contextWindow, cwd };
+  } catch {
+    return null;
+  }
+}
+
+function maybeResolveCodex(payload) {
+  if (!payload || typeof payload !== "object") return;
+  if (payload.provider !== "codex") return;
+  const sid = payload.session_id;
+  if (!sid) return;
+  codexUsageReads.run(sid, async () => {
+    const path = await findCodexRolloutPath(sid);
+    if (!path) return;
+    const r = await readCodexRollout(path);
+    if (!r) return;
+    if (r.usage) {
+      pushEvent({
+        hook_event_name: "UsageObserved",
+        session_id: sid,
+        usage: r.usage,
+      }, "internal");
+    }
+    if (r.model) {
+      pushEvent({
+        hook_event_name: "ModelObserved",
+        session_id: sid,
+        model: r.model,
+      }, "internal");
+    }
+    if (r.contextWindow) {
+      // Piggy-back on the model event with the window — reducer reads
+      // model_context_window directly off any payload.
+      pushEvent({
+        hook_event_name: "ModelObserved",
+        session_id: sid,
+        model: r.model ?? undefined,
+        model_context_window: r.contextWindow,
+      }, "internal");
+    }
+  });
+}
+
+/**
+ * Everything kept about one Codex session by id, dropped: where its rollout is,
+ * when its usage was last read, and the model and approval policy the
+ * translation remembers. Its one caller is forgetSession.
+ */
+function forgetCodexSession(sid) {
+  codexRolloutPathBySid.delete(sid);
+  codexUsageReads.forget(sid);
+  codexSessionModel.delete(sid);
+  codexSessionApproval.delete(sid);
+}
+
+// What event-pipeline.mjs and session-tracking.mjs call besides readCodexRollout
+// above, and findCodexRolloutPath for the suite, which pins the id it matches
+// against file names without a server in front of it. Listed rather than marked
+// at each declaration, so the declarations read as they did where they came
+// from.
+export { findCodexRolloutPath, forgetCodexSession, maybeResolveCodex };

package/src/server/codex-quota.mjs

@@ -8,8 +8,10 @@
 // optional, unknown values pass through verbatim, and a `partial` flag tells
 // the UI when something was dropped instead of silently showing less.
 import { readFile } from "node:fs/promises";
-// One clamp for both quota readers: see the note on cooldownFromHeader.
-import { cooldownFromHeader } from "./quota.mjs";
+// One clamp for both quota readers: see the note on cooldownFromHeader. From
+// quota-oauth.mjs, which owns it, rather than through quota.mjs, which only
+// re-exported it and brings the whole Claude quota chain with it.
+import { cooldownFromHeader } from "./quota-oauth.mjs";
 import { join } from "node:path";
 import { CODEX_HOME } from "./codex-dir.mjs";
 import { getCodexAuth, forceCodexRefresh, isCredentialHost } from "./codex-auth.mjs";
@@ -337,7 +339,7 @@ async function doFetchCodexQuota() {
   // than the ordinary floor before asking again. `retry-after` is honoured when
   // the backend sends one, because it knows better than the constant does.
   const cooldown = (res) => {
-    // Clamped, for the reason quota.mjs states at cooldownFromHeader: a `0`
+    // Clamped, for the reason quota-oauth.mjs states at cooldownFromHeader: a `0`
     // defeats the cooldown a 429 exists to impose, and a day freezes this
     // poller for the life of the process.
     _rateLimitedUntil = Date.now() + cooldownFromHeader(res?.headers?.get?.("retry-after"), COOLDOWN_MS);