ccdeck 3.41.3 → 3.43.0

package/src/server/codex-enrichment.mjs

@@ -18,8 +18,8 @@ import { STOP, rolloutNameId, walkRolloutDays } from "./codex-dir.mjs";
 // reads a rollout's lines by, the ones the translation reads — see
 // codex-translate.mjs.
 import {
-  codexSessionApproval, codexSessionModel,
-  responseItemModel, sessionMeta, taskStartedWindow, tokenCountInfo,
+  codexSessionApproval, codexSessionEffort, codexSessionModel,
+  responseItemModel, sessionMeta, taskStartedWindow, tokenCountInfo, turnContextEffort,
 } from "./codex-translate.mjs";
 // The bounded chunk reads the Claude transcripts use — see jsonl-chunks.mjs.
 import { readByteRange } from "./jsonl-chunks.mjs";
@@ -227,6 +227,8 @@ export async function readCodexRollout(path) {
     let model = null;
     let contextWindow = null;
     let cwd = null;
+    // Undefined until a turn_context is read: "no turn yet" is not "no effort".
+    let effort;
     for (const line of text.split("\n")) {
       if (!line) continue;
       let obj;
@@ -245,9 +247,11 @@ export async function readCodexRollout(path) {
       // Fallback model source — response items carry the model id.
       const itemModel = responseItemModel(obj);
       if (itemModel !== null) model = itemModel;
+      // The newest turn's effort (#2155), as the rollout watcher reads it.
+      if (obj?.type === "turn_context") effort = turnContextEffort(obj.payload);
     }
     if (!lastUsage && !model && !contextWindow) return null;
-    return { usage: lastUsage, model, contextWindow, cwd };
+    return { usage: lastUsage, model, contextWindow, cwd, effort };
   } catch {
     return null;
   }
@@ -275,6 +279,9 @@ function maybeResolveCodex(payload) {
         hook_event_name: "ModelObserved",
         session_id: sid,
         model: r.model,
+        // A hook-delivered session has no watcher to spread it, so it rides
+        // here, beside the model it qualifies.
+        ...(r.effort !== undefined ? { reasoning_effort: r.effort } : {}),
       }, "internal");
     }
     if (r.contextWindow) {
@@ -300,6 +307,7 @@ function forgetCodexSession(sid) {
   codexUsageReads.forget(sid);
   codexSessionModel.delete(sid);
   codexSessionApproval.delete(sid);
+  codexSessionEffort.delete(sid);
 }
 
 // What event-pipeline.mjs and session-tracking.mjs call besides readCodexRollout

package/src/server/codex-lineage.mjs

@@ -0,0 +1,29 @@
+// Read only explicit thread relationships. A model's prose is never ancestry.
+export function codexThreadLink(record, sessionId, cwd) {
+  const text = value => typeof value === "string" && value.trim() ? value : null;
+  let child, parent, details;
+  if (record?.type === "session_meta") {
+    details = record.payload;
+    const spawn = details?.source?.subagent?.thread_spawn;
+    const direct = text(details?.parent_thread_id);
+    const inherited = text(spawn?.parent_thread_id);
+    if (direct && inherited && direct !== inherited) return null;
+    parent = direct ?? inherited;
+    child = text(details?.id) ?? text(sessionId);
+    details = { ...spawn, ...details };
+  } else if (record?.type === "event_msg") {
+    const payload = record.payload;
+    details = payload?.type === "sub_agent_activity" ? payload
+      : payload?.item?.type === "SubAgentActivity" ? payload.item : null;
+    if (details?.kind !== "started") return null;
+    child = text(details.agent_thread_id);
+    parent = text(sessionId);
+  }
+  if (!child || !parent || child === parent) return null;
+  return {
+    hook_event_name: "CodexThreadLinked", provider: "codex",
+    session_id: child, parent_session_id: parent, cwd,
+    agent_nickname: text(details?.agent_nickname),
+    agent_role: text(details?.agent_role) ?? text(details?.agent_type),
+  };
+}

package/src/server/codex-recovery.mjs

@@ -0,0 +1,83 @@
+import { codexThreadLink } from "./codex-lineage.mjs";
+import { turnContextEffort } from "./codex-translate.mjs";
+import { stat } from "node:fs/promises";
+import { readAppendedLines } from "./jsonl-chunks.mjs";
+
+export const RECOVERY_TAIL_BYTES = 8 * 1024 * 1024;
+export const RECOVERY_FILE_LIMIT = 128;
+export const RECOVERY_SCAN_BYTES = 32 * 1024 * 1024;
+export const RECOVERY_RECENT_MS = 24 * 60 * 60 * 1000;
+
+/** A fixed prefix of an existing file. The live watcher resumes at offset. */
+export async function readCodexRecovery(path, initial, sid, cwd, factsBefore = Infinity) {
+  const from = Math.max(0, initial.size - RECOVERY_TAIL_BYTES);
+  const cursor = { offset: from, midLine: from > 0 };
+  const result = { active: false, at: null, turnId: null, prompt: undefined,
+    model: undefined, usage: undefined, window: undefined, effort: undefined,
+    approval: undefined, contextTokens: undefined, offset: initial.size, certain: true, links: [] };
+  let pendingPrompt;
+  { // The entire bounded tail fits in one reader chunk; never reread a partial suffix.
+    const { text, advanced } = await readAppendedLines(path, cursor, initial.size);
+    if (!advanced && initial.size > from) result.certain = false;
+    let lineEnd = cursor.offset - Buffer.byteLength(text) - 1;
+    for (const line of text.split("\n")) {
+      lineEnd += Buffer.byteLength(line) + 1;
+      if (!line) continue;
+      let row;
+      try { row = JSON.parse(line); } catch { result.certain = false; continue; }
+      const link = codexThreadLink(row, sid, cwd);
+      if (link) result.links.push(link);
+      const p = row?.payload;
+      if (row?.type === "turn_context") {
+        if (typeof p?.model === "string") result.model = p.model;
+        result.effort = turnContextEffort(p);
+        if (typeof p?.approval_policy === "string") result.approval = p.approval_policy;
+      }
+      if (row?.type !== "event_msg" || !p) continue;
+      if (p.type === "task_started") {
+        if (!result.active || result.turnId !== p.turn_id) result.prompt = pendingPrompt;
+        pendingPrompt = undefined;
+        result.active = true;
+        result.turnId = typeof p.turn_id === "string" ? p.turn_id : null;
+        result.at = Date.parse(row.timestamp);
+        if (typeof p.model_context_window === "number") result.window = p.model_context_window;
+      } else if (p.type === "task_complete" || p.type === "turn_aborted") {
+        if (!p.turn_id || !result.turnId || p.turn_id === result.turnId) {
+          result.active = false;
+          result.prompt = pendingPrompt = undefined;
+          result.turnId = null;
+          result.at = Date.parse(row.timestamp);
+        }
+      } else if (p.type === "token_count") {
+        if (p.info?.total_token_usage) result.usage = p.info.total_token_usage;
+        if (typeof p.info?.last_token_usage?.total_tokens === "number") result.contextTokens = p.info.last_token_usage.total_tokens;
+        if (typeof p.info?.model_context_window === "number") result.window = p.info.model_context_window;
+      }
+      const prompt = p.type === "user_message" && typeof p.message === "string" ? p.message
+        : p.item?.type === "UserMessage" && Array.isArray(p.item.content)
+          ? p.item.content.map(part => typeof part?.text === "string" ? part.text : "").join("") : null;
+      if (prompt && lineEnd <= factsBefore) {
+        if (result.active) result.prompt = prompt;
+        else pendingPrompt = prompt;
+      }
+    }
+  }
+  result.offset = cursor.offset;
+  // An incomplete final line might be the completion. Keep it for the tail,
+  // but do not call this snapshot active until the evidence is complete.
+  if (cursor.offset !== initial.size) result.certain = false;
+  const current = await stat(path);
+  if (current.size !== initial.size || current.dev !== initial.dev || current.ino !== initial.ino) result.certain = false;
+  return result;
+}
+
+/** Repeated rollouts of a resumed thread must agree on the newest boundary. */
+export function latestCodexRecovery(candidates) {
+  if (!candidates.length || candidates.some(c => !c.snapshot.certain)) return null;
+  if (candidates.length === 1) return candidates[0];
+  if (candidates.some(c => !Number.isFinite(c.snapshot.at))) return null;
+  const newest = Math.max(...candidates.map(c => c.snapshot.at));
+  const sameTime = candidates.filter(c => c.snapshot.at === newest);
+  if (sameTime.some(c => c.snapshot.active !== sameTime[0].snapshot.active)) return null;
+  return sameTime[sameTime.length - 1];
+}

package/src/server/codex-translate.mjs

@@ -19,6 +19,10 @@ export const codexSessionModel = new Map();   // sid -> last model string
 // session. See codexObjToPayload for why this is read and what it is NOT used
 // for; #398 for why the deck holds it at all.
 export const codexSessionApproval = new Map(); // sid -> last approval_policy string
+// sid -> the reasoning effort of the newest `turn_context`, or null when that
+// record named none (#2155). Spread onto every payload as `reasoning_effort`,
+// as approval_policy is, so the card says the effort the current turn runs at.
+export const codexSessionEffort = new Map();
 
 // ─── What a rollout record states ─────────────────────────────────────────
 // The record shapes more than one reader takes a fact off: the translation
@@ -55,6 +59,19 @@ export function taskStartedWindow(obj) {
     : null;
 }
 
+/**
+ * The reasoning effort a `turn_context` record says the turn runs at, or null
+ * when it names none (#2155). Codex writes it twice on every turn — `effort`,
+ * and again as `collaboration_mode.settings.reasoning_effort` — and the first
+ * is read first, the second only in its absence. Not a fixed set of words: the
+ * config reference lists `low` … `xhigh` and more, and says the levels depend
+ * on the model, so any short word is taken as written.
+ */
+export function turnContextEffort(pl) {
+  const effort = pl?.effort ?? pl?.collaboration_mode?.settings?.reasoning_effort;
+  return typeof effort === "string" && /^[a-z][a-z0-9_-]{0,23}$/i.test(effort) ? effort : null;
+}
+
 /** The model a `response_item` names, or null. */
 export function responseItemModel(obj) {
   const pl = obj && obj.payload;
@@ -93,6 +110,12 @@ export function codexObjToPayload(obj, sid, cwd) {
   // watcher reads. The reducer stamps it on the root beside `contextWindow`.
   const approval_policy = codexSessionApproval.get(sid);
   const base = { session_id: sid, cwd, provider: "codex", approval_policy };
+  // The effort, on the same terms — but sent as null once a turn_context named
+  // none, where approval_policy is left out: a policy that goes missing is a
+  // record that dropped a field, while a turn with no effort is a model that
+  // has none, and the chip must stop showing the last one. Before the first
+  // turn_context it is absent, which the page reads as "not known yet".
+  if (codexSessionEffort.has(sid)) base.reasoning_effort = codexSessionEffort.get(sid);
 
   // Track model from turn_context / response_item before mapping events.
   if (type === "turn_context") {
@@ -128,6 +151,7 @@ export function codexObjToPayload(obj, sid, cwd) {
     } else {
       codexSessionApproval.delete(sid);
     }
+    codexSessionEffort.set(sid, turnContextEffort(pl));
     return null;
   }
   const itemModel = responseItemModel(obj);

package/src/server/codex-watch.mjs

@@ -9,9 +9,9 @@
 // reads the ring or the SSE clients. index.mjs starts the watcher. The bodies
 // are unchanged.
 import { stat } from "node:fs/promises";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { PRODUCT } from "./brand.mjs";
-import { STOP, sidFromRolloutName, walkRolloutDays } from "./codex-dir.mjs";
+import { STOP, rolloutNameId, sidFromRolloutName, walkRolloutDays } from "./codex-dir.mjs";
 // What one rollout line means as a hook payload, and the shape of the header
 // record that says whose rollout it is — see codex-translate.mjs. The watcher
 // below still decides which lines are read and where each one goes.
@@ -29,6 +29,9 @@ import { maybeResolveCodexMemory } from "./session-enrichment.mjs";
 // event-pipeline.mjs's pushEvent, reached without importing it — see
 // event-sink.mjs.
 import { pushEvent } from "./event-sink.mjs";
+import { codexThreadLink } from "./codex-lineage.mjs";
+import { readCodexRecovery, latestCodexRecovery, RECOVERY_FILE_LIMIT, RECOVERY_RECENT_MS, RECOVERY_SCAN_BYTES, RECOVERY_TAIL_BYTES } from "./codex-recovery.mjs";
+import { heldPrefs, prefsRead } from "./prefs-state.mjs";
 
 // ─── Codex rollout watcher ────────────────────────────────────────────────
 // Codex CLI hooks never fire on Windows — the elevated/unelevated sandbox
@@ -219,7 +222,7 @@ async function readCodexHeader(path) {
           // workspace test below, the log election, the cwd on every event this
           // rollout produces — reads state.cwd, and this is the one place it is
           // read off disk. See canonicalCwd.
-          return { sid, cwd: await canonicalCwd(meta.cwd) };
+          return { sid, cwd: await canonicalCwd(meta.cwd), link: codexThreadLink(obj, sid, meta.cwd) };
         }
         // The other rename the scan would otherwise retry in silence: a first
         // line that is whole but is not a session_meta will never become one.
@@ -244,8 +247,8 @@ async function readCodexHeader(path) {
 // write it to the log they share. The event is still buffered and broadcast —
 // every deck watching the session draws it — it is only the second copy on disk
 // that is dropped. See writesCodexLog in log-election.mjs.
-function emitCodexEvent(payload, persist) {
-  pushEvent(payload, "codex", { persist });
+function emitCodexEvent(payload, persist, toolAuditAt) {
+  pushEvent(payload, "codex", { persist, toolAuditAt });
 }
 
 /**
@@ -313,6 +316,7 @@ function emitCodexEvent(payload, persist) {
 function ensureCodexRoot(state, persist) {
   if (state.rootOpened) return;
   state.rootOpened = true;
+  if (state.link) emitCodexEvent({ ...state.link, cwd: state.cwd }, persist);
   if (!state.sawBeginning) return;
   emitCodexEvent({ session_id: state.sid, cwd: state.cwd, provider: "codex", hook_event_name: "SessionStart" }, persist);
 }
@@ -325,7 +329,7 @@ function ensureCodexRoot(state, persist) {
  * skipping cursor is parked at its end; or this is the first scan, and the
  * file's history is skipped.
  */
-async function openCodexCursor(path, st, now, firstRun) {
+async function openCodexCursor(path, st, now, firstRun, recover = false) {
   // New file — read the header for sid + cwd, then decide whether to
   // capture it. Skip files outside our workspace.
   const header = await readCodexHeader(path);
@@ -347,7 +351,7 @@ async function openCodexCursor(path, st, now, firstRun) {
   // UsageObserved in the file to every tab, and re-appending the lot to
   // the shared events.jsonl if this deck is the elected writer (#981).
   const fresh = !codexSeenEver.has(path);
-  const state = { offset: fresh ? 0 : st.size, sid: header.sid, cwd: header.cwd, skip: false, sawBeginning: fresh, rootOpened: false, seenAt: now };
+  const state = { offset: fresh ? 0 : st.size, sid: header.sid, cwd: header.cwd, link: header.link, skip: false, sawBeginning: fresh, rootOpened: false, seenAt: now };
   codexFileState.set(path, state);
   rememberCodexPath(path);
   if (firstRun) {
@@ -379,6 +383,16 @@ async function openCodexCursor(path, st, now, firstRun) {
     // brace (#981).
     state.offset = st.size;
     state.sawBeginning = false;
+    if (recover) {
+      try {
+        state.recovery = await readCodexRecovery(path, st, state.sid, state.cwd);
+        state.recoveryObservedAt ??= now;
+        state.recoverySize = st.size;
+        state.recoveryBootSize = st.size;
+        state.offset = state.recovery.offset;
+      } catch { state.recovery = { certain: false }; }
+      return state;
+    }
     return null;
   }
   return state;
@@ -397,6 +411,11 @@ function emitCodexLines(state, consume, persist) {
     try { obj = JSON.parse(line); } catch { continue; }
     const prevModel = codexSessionModel.get(state.sid);
     const payload = codexObjToPayload(obj, state.sid, state.cwd);
+    const link = codexThreadLink(obj, state.sid, state.cwd);
+    if (link) {
+      ensureCodexRoot(state, persist);
+      emitCodexEvent(link, persist);
+    }
     // If the model changed (turn_context/response_item), surface it.
     const nowModel = codexSessionModel.get(state.sid);
     if (nowModel && nowModel !== prevModel) {
@@ -405,7 +424,7 @@ function emitCodexLines(state, consume, persist) {
     }
     if (payload) {
       ensureCodexRoot(state, persist);
-      emitCodexEvent(payload, persist);
+      emitCodexEvent(payload, persist, typeof obj.timestamp === "string" ? Date.parse(obj.timestamp) : undefined);
     }
   }
 }
@@ -467,7 +486,7 @@ async function openGrownOlderRollouts(now) {
     // Never `sawBeginning`, whatever this process read of the file before: the
     // lines before `was` are ones this deck has either drawn already or joined
     // too late for, and either way a SessionStart now would be a false one.
-    const state = { offset: skip ? st.size : was, sid: header.sid, cwd: header.cwd, skip, sawBeginning: false, rootOpened: false, seenAt: now, mtimeMs: st.mtimeMs };
+    const state = { offset: skip ? st.size : was, sid: header.sid, cwd: header.cwd, link: header.link, skip, sawBeginning: false, rootOpened: false, seenAt: now, mtimeMs: st.mtimeMs };
     codexFileState.set(path, state);
     rememberCodexPath(path);
     opened.push({ path, st, state });
@@ -497,7 +516,12 @@ export async function scanCodexNow() {
 
 async function scanRollouts(firstRun) {
   try {
+    if (firstRun) await prefsRead;
     const now = Date.now();
+    const recoverAtBoot = firstRun && heldPrefs.current().recoverCodexSessions !== false;
+    let recoveryBudget = RECOVERY_FILE_LIMIT;
+    let olderStatBudget = RECOVERY_FILE_LIMIT;
+    let recoveryBytes = RECOVERY_SCAN_BYTES;
     // Read at most once per scan, and only from the first rollout that actually
     // has new bytes: most ticks read nothing and must not pay a directory
     // listing for the answer to a question nothing is asking.
@@ -508,7 +532,9 @@ async function scanRollouts(firstRun) {
     // `null` rather than 0 for "never", so a clock that starts near the epoch,
     // or a faked one, cannot make boot look recent.
     const walkAll = codexOlderWalkedAt == null || Math.abs(now - codexOlderWalkedAt) >= CODEX_STATE_TTL_MS;
-    const { files, older } = await listRecentCodexRollouts(walkAll);
+    const { files: recentFiles, older } = await listRecentCodexRollouts(walkAll);
+    const recent = new Set(recentFiles);
+    const files = recoverAtBoot ? [...recentFiles, ...older] : recentFiles;
     if (walkAll) { codexOlderWalkedAt = now; catalogOlderRollouts(older); }
     const listed = new Set(files);
     // Every rollout this tick has a reason to read, with its stat and cursor:
@@ -516,14 +542,20 @@ async function scanRollouts(firstRun) {
     // rollouts found grown. One pass reads them all below.
     const due = [];
     for (const path of files) {
-      codexOlderRollouts.delete(path); // listed, so the listing's
+      if (!recent.has(path) && olderStatBudget-- <= 0) continue;
       let st;
       try { st = await stat(path); } catch { continue; }
+      const eligible = recoverAtBoot && now - st.mtimeMs <= RECOVERY_RECENT_MS;
+      if (!recent.has(path) && (!eligible || recoveryBudget <= 0)) continue;
+      codexOlderRollouts.delete(path);
       let state = codexFileState.get(path);
       if (state) state.seenAt = now;
 
       if (!state) {
-        state = await openCodexCursor(path, st, now, firstRun);
+        const cost = Math.min(st.size, RECOVERY_TAIL_BYTES);
+        const recover = eligible && recoveryBudget > 0 && cost <= recoveryBytes;
+        if (recover) { recoveryBudget--; recoveryBytes -= cost; }
+        state = await openCodexCursor(path, st, now, firstRun, recover);
         if (!state) continue;
       }
       state.mtimeMs = st.mtimeMs;
@@ -542,6 +574,78 @@ async function scanRollouts(firstRun) {
     }
     due.push(...await openGrownOlderRollouts(now));
 
+    // Retry an unstable prefix only after its file changes. The live cursor
+    // stays behind an incomplete line and never replays skipped tool history.
+    let retryBudget = 16;
+    for (const entry of due) {
+      const { state, path, st } = entry;
+      const cost = Math.min(st.size, RECOVERY_TAIL_BYTES);
+      if (!firstRun && state.recovery && !state.recovery.certain && retryBudget > 0 && cost <= recoveryBytes && st.size !== state.recoverySize) {
+        recoveryBytes -= cost;
+        retryBudget--;
+        try {
+          state.recovery = await readCodexRecovery(path, st, state.sid, state.cwd, state.recoveryBootSize);
+          state.recoveryObservedAt ??= now;
+          // Keep the live cursor: bytes appended since boot are emitted below.
+        } catch { state.recovery = { certain: false }; }
+        state.recoverySize = st.size;
+      }
+    }
+    const bySession = new Map();
+    for (const entry of due) {
+      if (!entry.state.recovery) continue;
+      const candidates = bySession.get(entry.state.sid) ?? [];
+      candidates.push({ ...entry, snapshot: entry.state.recovery });
+      bySession.set(entry.state.sid, candidates);
+    }
+    const knownPathsBySession = new Map();
+    const unknownPaths = [];
+    if (bySession.size) for (const path of new Set([...files, ...codexOlderRollouts.keys(), ...codexFileState.keys()])) {
+      const sid = rolloutNameId(basename(path));
+      if (!sid) { unknownPaths.push(path); continue; }
+      const paths = knownPathsBySession.get(sid) ?? [];
+      paths.push(path); knownPathsBySession.set(sid, paths);
+    }
+    const selected = new Map();
+    for (const [sid, candidates] of bySession) {
+      // A resumed thread's unexamined rollout may contain a newer ending.
+      // Compare exact filename ids, including historical directories, before
+      // accepting a bounded selection. Unknown names make recovery uncertain.
+      const inspected = new Set(candidates.map(c => c.path));
+      const unseen = [...(knownPathsBySession.get(sid) ?? []), ...unknownPaths].some(path => !inspected.has(path));
+      const best = unseen ? null : latestCodexRecovery(candidates);
+      if (!best || !Number.isFinite(best.snapshot.at)) continue;
+      selected.set(sid, { candidates, best });
+    }
+    const recoveredLinks = [];
+    for (const { candidates, best } of selected.values()) {
+      const { state, snapshot } = best;
+      const signature = candidates.map(c => `${c.path}:${c.snapshot.offset}`).join("|");
+      if (candidates.every(c => c.state.recoveryEmitted === signature)) continue;
+      for (const c of candidates) c.state.recoveryEmitted = signature;
+      state.rootOpened = true;
+      pushEvent({
+        hook_event_name: "CodexSessionRecovered", provider: "codex",
+        session_id: state.sid, cwd: state.cwd, snapshot_observed_at: Math.min(...candidates.map(c => c.state.recoveryObservedAt ?? now)),
+        recovery_active: snapshot.active,
+        turn_started_at: snapshot.at, prompt: snapshot.prompt, model: snapshot.model,
+        usage: snapshot.usage, context_tokens: snapshot.contextTokens,
+        model_context_window: snapshot.window, approval_policy: snapshot.approval,
+        reasoning_effort: snapshot.effort,
+      }, "codex", { replay: true, persist: false });
+      if (snapshot.active) {
+        if (state.link) recoveredLinks.push({ ...state.link, cwd: state.cwd });
+        for (const link of snapshot.links ?? []) {
+          // Historical ancestry alone cannot establish that a child is active.
+          if (selected.get(link.session_id)?.best.snapshot.active) recoveredLinks.push(link);
+        }
+      }
+      // Keep terminal candidates too: a sibling rollout still being written
+      // must be reconciled against this ending on its next stable snapshot.
+      for (const c of candidates) c.state.recoverySize = c.st.size;
+    }
+    // Snapshots precede relationships so a child placeholder cannot overtake its facts.
+    for (const link of recoveredLinks) pushEvent(link, "codex", { replay: true, persist: false });
     for (const { path, st, state } of due) {
       if (state.skip) { state.offset = st.size; continue; }
       // A cursor sitting PAST the end of the file is a different thing from