codiedev 0.9.55 → 0.9.56

package/dist/captureLog.d.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 export declare const CAPTURE_LOG_MAX_BYTES: number;
 export declare const CAPTURE_LOG_PATH: string;
 export interface CaptureLogEntry {
-    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr";
+    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr" | "limit";
     sessionId: string | undefined;
     outcome: string;
     detail?: string;

package/dist/codexLimitScan.d.ts

@@ -0,0 +1,64 @@
+import { type LimitEvent } from "./limitEvent";
+import type { LimitEventPayload } from "./limitEventReporter";
+export interface CodexLimitHit {
+    event: LimitEvent;
+    /** Byte offset just past the matched line — the tail ends here, not at EOF. */
+    lineEnd: number;
+}
+export interface ScanOptions {
+    chunkSize?: number;
+    maxScanBytes?: number;
+}
+/**
+ * Find the LAST rate-limit/credit block recorded in a Codex rollout file.
+ * Returns null when the session was never blocked.
+ */
+export declare function scanCodexRolloutForLimit(filePath: string, options?: ScanOptions): CodexLimitHit | null;
+/**
+ * Read up to `maxBytes` of the rollout ENDING at `lineEnd` — the work the
+ * developer was doing when the block hit, not whatever the session did after
+ * the window reset. Resumes at a line boundary so every JSONL line parses.
+ */
+export declare function readTailEndingAt(filePath: string, lineEnd: number, maxBytes?: number): string;
+export interface FindRolloutOptions {
+    withinMs?: number;
+    maxFiles?: number;
+    now?: number;
+}
+/** Codex rollout files, newest first, limited by age and count. */
+export declare function findRecentCodexRollouts(sessionsDir: string, options?: FindRolloutOptions): string[];
+/** Codex names rollouts `rollout-<ISO local time>-<session id>.jsonl`. */
+export declare function sessionIdFromRolloutPath(filePath: string): string | undefined;
+/** Where Codex writes its rollout JSONL files. */
+export declare function codexSessionsDir(): string;
+export declare const CODEX_LIMIT_STATE_PATH: string;
+/**
+ * Record a block reported outside the sweep (the Stop path), so the next
+ * prompt sweep neither re-scans the rollout nor re-posts the event.
+ */
+export declare function recordCodexLimitReported(filePath: string, at: number, statePath?: string): void;
+export interface SweepArgs {
+    sessionsDir: string;
+    statePath?: string;
+    post: (payload: LimitEventPayload) => Promise<void>;
+    findOptions?: FindRolloutOptions;
+    scanOptions?: ScanOptions;
+    /** How many rollouts may actually be READ in one sweep. */
+    maxScans?: number;
+    /** Stop starting new scans once this many ms have elapsed. */
+    deadlineMs?: number;
+}
+/**
+ * Report every Codex block this machine has not reported yet. Returns how many
+ * events were posted. Never throws — it runs inside a hook.
+ *
+ * State is kept PER FILE, not as one newest-wins timestamp. A single global
+ * watermark loses data: rollouts are capped per sweep, so a block in a file
+ * outside the cap can be older than one already reported and would then be
+ * suppressed forever. A per-file record can only ever cause a re-report, which
+ * the server deduplicates on (companyId, userId, at).
+ *
+ * A file is recorded only after its POST succeeds, so a failed send is retried
+ * on the next prompt.
+ */
+export declare function sweepCodexLimits(args: SweepArgs): Promise<number>;

package/dist/codexLimitScan.js

@@ -0,0 +1,466 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_LIMIT_STATE_PATH = void 0;
+exports.scanCodexRolloutForLimit = scanCodexRolloutForLimit;
+exports.readTailEndingAt = readTailEndingAt;
+exports.findRecentCodexRollouts = findRecentCodexRollouts;
+exports.sessionIdFromRolloutPath = sessionIdFromRolloutPath;
+exports.codexSessionsDir = codexSessionsDir;
+exports.recordCodexLimitReported = recordCodexLimitReported;
+exports.sweepCodexLimits = sweepCodexLimits;
+// Reporting a Codex credit/rate-limit block.
+//
+// WHY THIS EXISTS: the `limit-codex` reporter is a Codex `Stop` hook, and
+// Codex does NOT run Stop hooks on the turn a block kills. Measured on real
+// rollouts: every normal `task_complete` pairs with a Stop-hook run within
+// ~200ms, and the blocked one never does (21 turns → 20 runs; 11 → 10, short
+// by exactly the blocked turn each time). Claude Code has a dedicated
+// StopFailure event with a `rate_limit` matcher, which is why it reports
+// correctly; Codex's HookEventName enum has no equivalent — there is no event
+// at all that fires at the block.
+//
+// So the block can only be reported LATER, from a hook that does run. This
+// module scans the rollout files Codex has already written and reports any
+// block that has not been reported yet. It is driven from UserPromptSubmit
+// (`discover-codex`), which fires on the developer's next prompt — in the
+// blocked session or in a new one — and from Stop, which still catches the
+// (rarer) case of a block followed by more turns.
+//
+// The scan reads BACKWARDS from end of file. The previous reader took a fixed
+// 512 KB tail, which silently lost the event whenever the session kept writing
+// after the block: in one real 44 MB rollout the marker sat 1.13 MB from the
+// end, outside the window, and the parse returned null.
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const limitEvent_1 = require("./limitEvent");
+const configDir_1 = require("./configDir");
+const MARKER = Buffer.from("rate_limit_reached_type");
+const SPEND_MARKER = Buffer.from("spend_control_reached");
+const NEWLINE = 0x0a;
+// Read backwards in 256 KB chunks, and give up after 16 MB. Codex rollouts run
+// to tens of megabytes, but a block is always in the session's LAST turn — the
+// bytes after it are whatever the session did once the window reset. 16 MB
+// covers that comfortably without ever loading a whole rollout.
+const DEFAULT_CHUNK_SIZE = 256 * 1024;
+const DEFAULT_MAX_SCAN_BYTES = 16 * 1024 * 1024;
+// Tail shipped to the server so it can summarize what the developer was doing
+// when they got blocked. Matches the server-side cap in http.ts.
+const DEFAULT_TAIL_BYTES = 64 * 1024;
+/**
+ * Find the LAST rate-limit/credit block recorded in a Codex rollout file.
+ * Returns null when the session was never blocked.
+ */
+function scanCodexRolloutForLimit(filePath, options = {}) {
+    const chunkSize = options.chunkSize ?? DEFAULT_CHUNK_SIZE;
+    const maxScanBytes = options.maxScanBytes ?? DEFAULT_MAX_SCAN_BYTES;
+    let size = 0;
+    try {
+        size = fs.statSync(filePath).size;
+    }
+    catch {
+        return null;
+    }
+    if (size === 0)
+        return null;
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+    }
+    catch {
+        return null;
+    }
+    try {
+        let pos = size;
+        // Bytes of the (earlier-read) chunk that belong to a line whose start we
+        // have not reached yet. Carried into the next, earlier chunk.
+        let carry = Buffer.alloc(0);
+        let scanned = 0;
+        while (pos > 0 && scanned < maxScanBytes) {
+            const length = Math.min(chunkSize, pos, maxScanBytes - scanned);
+            if (length <= 0)
+                break;
+            pos -= length;
+            const chunk = Buffer.allocUnsafe(length);
+            const read = fs.readSync(fd, chunk, 0, length, pos);
+            scanned += read;
+            const window = Buffer.concat([chunk.subarray(0, read), carry]);
+            // At pos > 0 the first line in the window is partial — its start lies in
+            // an earlier chunk — so hold it back rather than parse a torn line.
+            let completeStart = 0;
+            if (pos > 0) {
+                const firstNewline = window.indexOf(NEWLINE);
+                if (firstNewline < 0) {
+                    // The whole window is one unterminated line. A token_count record is
+                    // ~1 KB, so a line this long is never the one we want: drop it rather
+                    // than grow the carry without bound.
+                    carry = window.length > maxScanBytes ? Buffer.alloc(0) : window;
+                    continue;
+                }
+                completeStart = firstNewline + 1;
+                carry = window.subarray(0, completeStart);
+            }
+            else {
+                carry = Buffer.alloc(0);
+            }
+            const region = window.subarray(completeStart);
+            if (region.indexOf(MARKER) < 0 && region.indexOf(SPEND_MARKER) < 0)
+                continue;
+            // Walk this window's complete lines from the end backwards; the first
+            // match going backwards is the latest one in the file.
+            const bounds = [];
+            let lineStart = 0;
+            for (let index = 0; index < region.length; index += 1) {
+                if (region[index] === NEWLINE) {
+                    bounds.push([lineStart, index + 1]);
+                    lineStart = index + 1;
+                }
+            }
+            if (lineStart < region.length)
+                bounds.push([lineStart, region.length]);
+            for (let index = bounds.length - 1; index >= 0; index -= 1) {
+                const [start, end] = bounds[index];
+                const event = (0, limitEvent_1.parseCodexLimitEventFromTranscript)(region.subarray(start, end).toString("utf8"));
+                if (event)
+                    return { event, lineEnd: pos + completeStart + end };
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+/**
+ * Read up to `maxBytes` of the rollout ENDING at `lineEnd` — the work the
+ * developer was doing when the block hit, not whatever the session did after
+ * the window reset. Resumes at a line boundary so every JSONL line parses.
+ */
+function readTailEndingAt(filePath, lineEnd, maxBytes = DEFAULT_TAIL_BYTES) {
+    // Clamp to the file as it is NOW: the offset came from an earlier scan, and
+    // reading past EOF would return a short, garbled tail.
+    let end = lineEnd;
+    try {
+        end = Math.min(lineEnd, fs.statSync(filePath).size);
+    }
+    catch {
+        return "";
+    }
+    const start = Math.max(0, end - maxBytes);
+    const length = end - start;
+    if (length <= 0)
+        return "";
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+    }
+    catch {
+        return "";
+    }
+    try {
+        const buffer = Buffer.allocUnsafe(length);
+        const read = fs.readSync(fd, buffer, 0, length, start);
+        const text = buffer.subarray(0, read).toString("utf8");
+        if (start === 0)
+            return text;
+        const newline = text.indexOf("\n");
+        return newline === -1 ? "" : text.slice(newline + 1);
+    }
+    catch {
+        return "";
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+const DEFAULT_WITHIN_MS = 24 * 3600_000;
+const DEFAULT_MAX_FILES = 12;
+/** Codex rollout files, newest first, limited by age and count. */
+function findRecentCodexRollouts(sessionsDir, options = {}) {
+    const withinMs = options.withinMs ?? DEFAULT_WITHIN_MS;
+    const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
+    const now = options.now ?? Date.now();
+    const found = [];
+    const walk = (directory, depth) => {
+        if (depth > 5)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(directory, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(directory, entry.name);
+            if (entry.isDirectory()) {
+                walk(full, depth + 1);
+                continue;
+            }
+            if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
+                continue;
+            try {
+                const mtime = fs.statSync(full).mtimeMs;
+                if (now - mtime > withinMs)
+                    continue;
+                found.push({ file: full, mtime });
+            }
+            catch {
+                /* unreadable — skip */
+            }
+        }
+    };
+    walk(sessionsDir, 0);
+    return found
+        .sort((left, right) => right.mtime - left.mtime)
+        .slice(0, maxFiles)
+        .map((entry) => entry.file);
+}
+/** Codex names rollouts `rollout-<ISO local time>-<session id>.jsonl`. */
+function sessionIdFromRolloutPath(filePath) {
+    const match = path.basename(filePath).match(/^rollout-.*?T[\d-]+-(.+)\.jsonl$/);
+    return match ? match[1] : undefined;
+}
+/** Where Codex writes its rollout JSONL files. */
+function codexSessionsDir() {
+    return path.join(os.homedir(), ".codex", "sessions");
+}
+exports.CODEX_LIMIT_STATE_PATH = path.join((0, configDir_1.codiedevStateDir)(), "codex-limit-state.json");
+// Bounds the state file on a machine with a long Codex history.
+const MAX_STATE_ENTRIES = 500;
+function readSweepState(statePath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(statePath, "utf8"));
+    }
+    catch {
+        return { seen: {} };
+    }
+    const seen = {};
+    const raw = parsed.seen;
+    if (raw && typeof raw === "object") {
+        for (const [file, value] of Object.entries(raw)) {
+            const record = value;
+            if (typeof record?.size !== "number")
+                continue;
+            seen[file] = {
+                size: record.size,
+                mtime: typeof record.mtime === "number" ? record.mtime : -1,
+                at: typeof record.at === "number" ? record.at : null,
+                t: typeof record.t === "number" ? record.t : 0,
+            };
+        }
+    }
+    // Migrate the 0.10.0-beta shape ({ reportedThrough, clean }). The old global
+    // watermark is DELIBERATELY dropped rather than carried over: it is exactly
+    // what could suppress an older block forever. Re-reporting is safe — the
+    // server deduplicates on (companyId, userId, at).
+    const legacyClean = parsed.clean;
+    if (legacyClean && typeof legacyClean === "object") {
+        for (const [file, size] of Object.entries(legacyClean)) {
+            if (typeof size === "number" && !seen[file])
+                seen[file] = { size, mtime: -1, at: null, t: 0 };
+        }
+    }
+    return { seen };
+}
+// A record is dropped only once its file has been gone for a while. Pruning
+// the moment a path is missing would re-report an already-sent block after any
+// transient rename or move.
+const PRUNE_AFTER_MS = 7 * 24 * 3600_000;
+function pruneSweepState(state, now) {
+    for (const [file, record] of Object.entries(state.seen)) {
+        if (now - (record.t ?? 0) < PRUNE_AFTER_MS)
+            continue;
+        if (!fs.existsSync(file))
+            delete state.seen[file];
+    }
+    const files = Object.keys(state.seen);
+    if (files.length <= MAX_STATE_ENTRIES)
+        return;
+    files
+        .sort((left, right) => (state.seen[right].t ?? 0) - (state.seen[left].t ?? 0))
+        .slice(MAX_STATE_ENTRIES)
+        .forEach((file) => delete state.seen[file]);
+}
+/**
+ * Merge our records into whatever is on disk NOW and write the result. Two
+ * Codex sessions can submit a prompt at the same time; a plain
+ * read-modify-write would silently drop the other process's records.
+ */
+function commitSweepState(statePath, ours, now) {
+    const current = readSweepState(statePath);
+    for (const [file, record] of Object.entries(ours))
+        current.seen[file] = record;
+    pruneSweepState(current, now);
+    writeSweepState(statePath, current);
+}
+function writeSweepState(statePath, state) {
+    // Written through a temp file and renamed: Codex kills a hook that overruns
+    // its timeout, and a half-written state file would read as "nothing seen"
+    // and re-report every block in the window.
+    const temp = `${statePath}.${process.pid}.tmp`;
+    try {
+        fs.mkdirSync(path.dirname(statePath), { recursive: true });
+        fs.writeFileSync(temp, JSON.stringify(state), "utf8");
+        fs.renameSync(temp, statePath);
+    }
+    catch {
+        try {
+            fs.unlinkSync(temp);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+function fingerprint(filePath) {
+    try {
+        const stat = fs.statSync(filePath);
+        return { size: stat.size, mtime: stat.mtimeMs };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Record a block reported outside the sweep (the Stop path), so the next
+ * prompt sweep neither re-scans the rollout nor re-posts the event.
+ */
+function recordCodexLimitReported(filePath, at, statePath = exports.CODEX_LIMIT_STATE_PATH) {
+    const print = fingerprint(filePath);
+    if (!print)
+        return;
+    commitSweepState(statePath, { [filePath]: { ...print, at, t: Date.now() } }, Date.now());
+}
+// Candidates are listed generously and settled by one statSync each; only
+// files that actually changed cost a read. The budget therefore bounds work
+// without letting idle sessions bury an unreported block.
+//
+// The budget binds only on a COLD START, where nothing has been seen before,
+// so it must be big enough to finish that first pass. A budget of 8 silently
+// starved the older blocked rollouts on a real machine: 49 candidates in the
+// window, the newest 8 all unblocked, nothing reported. A full pass over
+// those 49 costs ~205ms — the backward scan stops at the marker rather than
+// reading each file to its cap — so the budget can afford to cover them.
+const DEFAULT_CANDIDATES = 200;
+const DEFAULT_MAX_SCANS = 64;
+// The budget bounds how MANY files are read; this bounds how LONG. A count is
+// not enough on a slow or network-mounted disk, and this runs on the user's
+// prompt clock. Whatever is not reached stays unrecorded, so the next prompt
+// picks it up rather than skipping it.
+const DEFAULT_DEADLINE_MS = 1_500;
+/**
+ * Report every Codex block this machine has not reported yet. Returns how many
+ * events were posted. Never throws — it runs inside a hook.
+ *
+ * State is kept PER FILE, not as one newest-wins timestamp. A single global
+ * watermark loses data: rollouts are capped per sweep, so a block in a file
+ * outside the cap can be older than one already reported and would then be
+ * suppressed forever. A per-file record can only ever cause a re-report, which
+ * the server deduplicates on (companyId, userId, at).
+ *
+ * A file is recorded only after its POST succeeds, so a failed send is retried
+ * on the next prompt.
+ */
+async function sweepCodexLimits(args) {
+    const statePath = args.statePath ?? exports.CODEX_LIMIT_STATE_PATH;
+    const state = readSweepState(statePath);
+    const files = findRecentCodexRollouts(args.sessionsDir, {
+        maxFiles: DEFAULT_CANDIDATES,
+        ...args.findOptions,
+    });
+    const now = Date.now();
+    const touched = {};
+    let budget = args.maxScans ?? DEFAULT_MAX_SCANS;
+    const deadline = now + (args.deadlineMs ?? DEFAULT_DEADLINE_MS);
+    const pending = [];
+    for (const file of files) {
+        const print = fingerprint(file);
+        if (!print)
+            continue;
+        const record = state.seen[file];
+        // Settled by the stat alone — it has not changed since the last scan, so
+        // it holds nothing new and does not spend the read budget.
+        if (record && record.size === print.size && record.mtime === print.mtime)
+            continue;
+        if (budget <= 0 || Date.now() >= deadline)
+            break;
+        budget -= 1;
+        const hit = scanCodexRolloutForLimit(file, args.scanOptions);
+        if (!hit) {
+            touched[file] = { ...print, at: null, t: now };
+            continue;
+        }
+        if (record && record.at === hit.event.at) {
+            // Same block, already reported; the file just grew.
+            touched[file] = { ...print, at: record.at, t: now };
+            continue;
+        }
+        pending.push({ file, print, hit });
+    }
+    // Posted concurrently: each file is independent, and this runs on the
+    // prompt path where a serial chain of network timeouts would be felt.
+    const results = await Promise.allSettled(pending.map(({ file, hit }) => args.post({
+        source: "codex",
+        ...hit.event,
+        sessionId: sessionIdFromRolloutPath(file),
+        transcriptTail: readTailEndingAt(file, hit.lineEnd),
+    })));
+    let posted = 0;
+    results.forEach((result, index) => {
+        if (result.status !== "fulfilled")
+            return;
+        const { file, print, hit } = pending[index];
+        touched[file] = { ...print, at: hit.event.at, t: now };
+        posted += 1;
+    });
+    commitSweepState(statePath, touched, now);
+    return posted;
+}

package/dist/hook.js

@@ -44,6 +44,7 @@ const http = __importStar(require("http"));
 const child_process_1 = require("child_process");
 const utils_1 = require("./utils");
 const limitEventReporter_1 = require("./limitEventReporter");
+const codexLimitScan_1 = require("./codexLimitScan");
 const version_1 = require("./version");
 const captureLog_1 = require("./captureLog");
 const captureExclusions_1 = require("./captureExclusions");
@@ -143,10 +144,96 @@ async function runStopFailure(hookInput) {
     await readAndPostLimitEvent(hookInput, "claude-code", true);
     process.exit(0);
 }
+// Codex path. Two things differ from Claude Code:
+//
+// 1. There is no event that fires when a credit/rate-limit block kills a turn.
+//    Codex skips its Stop hook for exactly that turn (measured: every normal
+//    task_complete pairs with a Stop-hook run, the blocked one never does),
+//    and its HookEventName enum has no StopFailure equivalent. So the block is
+//    reported from the developer's NEXT prompt instead — see runCodexLimitSweep.
+// 2. Rollouts run to tens of megabytes and keep growing after the block, so a
+//    fixed tail read loses the marker (in one real 44 MB rollout it sat 1.13 MB
+//    from the end). Scan backwards for it instead.
+async function reportCodexLimitFromFile(config, transcriptPath, sessionId) {
+    const hit = (0, codexLimitScan_1.scanCodexRolloutForLimit)(transcriptPath);
+    if (!hit)
+        return false;
+    await (0, limitEventReporter_1.postLimitEvent)(config, {
+        source: "codex",
+        ...hit.event,
+        sessionId: sessionId ?? (0, codexLimitScan_1.sessionIdFromRolloutPath)(transcriptPath),
+        transcriptTail: (0, codexLimitScan_1.readTailEndingAt)(transcriptPath, hit.lineEnd),
+    });
+    // Tell the prompt sweep this one is done, so it neither re-scans the
+    // rollout nor re-posts an event the server would only deduplicate.
+    (0, codexLimitScan_1.recordCodexLimitReported)(transcriptPath, hit.event.at);
+    return true;
+}
 async function runCodexLimit(hookInput) {
-    await readAndPostLimitEvent(hookInput, "codex", false);
+    const config = (0, utils_1.readConfig)();
+    const transcriptPath = hookInput.transcript_path;
+    if (config && transcriptPath) {
+        try {
+            const sent = await reportCodexLimitFromFile(config, transcriptPath, hookInput.session_id);
+            if (sent) {
+                (0, captureLog_1.appendCaptureLog)({
+                    stage: "limit",
+                    sessionId: hookInput.session_id,
+                    outcome: "ok",
+                    detail: "source=codex trigger=stop",
+                });
+            }
+        }
+        catch (err) {
+            (0, captureLog_1.appendCaptureLog)({
+                stage: "limit",
+                sessionId: hookInput.session_id,
+                outcome: "ERROR",
+                detail: `source=codex trigger=stop ${err.message}`,
+            });
+        }
+    }
     process.exit(0);
 }
+const PROMPT_LIMIT_POST_TIMEOUT_MS = 2_500;
+// UserPromptSubmit: the first Codiedev hook that runs after a block, because
+// Codex runs no hook at the block itself. Scans the recent rollouts for any
+// block not yet reported. Cheap in the normal case — a per-file size cache
+// means an unchanged, unblocked rollout costs one statSync.
+async function runCodexLimitSweep(sessionId) {
+    const config = (0, utils_1.readConfig)();
+    if (!config)
+        return;
+    try {
+        const posted = await (0, codexLimitScan_1.sweepCodexLimits)({
+            sessionsDir: (0, codexLimitScan_1.codexSessionsDir)(),
+            // A shorter timeout than the default: this is on the user's prompt
+            // clock, and the next prompt retries anything that does not land.
+            post: (payload) => (0, limitEventReporter_1.postLimitEvent)(config, payload, PROMPT_LIMIT_POST_TIMEOUT_MS),
+            // Unchanged rollouts cost one statSync and do not spend the read
+            // budget, so in steady state this is nearly free. The module default
+            // covers a cold start; see DEFAULT_MAX_SCANS for why it is not small.
+            findOptions: { withinMs: 24 * 3600_000 },
+            scanOptions: { maxScanBytes: 4 * 1024 * 1024 },
+        });
+        if (posted > 0) {
+            (0, captureLog_1.appendCaptureLog)({
+                stage: "limit",
+                sessionId,
+                outcome: "ok",
+                detail: `source=codex trigger=prompt events=${posted}`,
+            });
+        }
+    }
+    catch (err) {
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "limit",
+            sessionId,
+            outcome: "ERROR",
+            detail: `source=codex trigger=prompt ${err.message}`,
+        });
+    }
+}
 // Skip-reason ping: this session is ending WITHOUT a capture, and here's why.
 // Turns silent coverage loss into per-reason buckets on the admin Capture
 // Health panel (patches the session's aiSessionStarts row server-side). Tiny
@@ -454,6 +541,11 @@ async function main() {
     if (process.argv[2] === "discover" ||
         process.argv[2] === "discover-codex" ||
         process.argv[2] === "discover-codie") {
+        // A Codex block leaves no hook of its own, so this prompt is the first
+        // chance to report it. Runs before runDiscover, which exits the process.
+        if (process.argv[2] === "discover-codex") {
+            await runCodexLimitSweep(hookInput.session_id);
+        }
         await runDiscover(hookInput.prompt);
         return;
     }

package/dist/limitEvent.js

@@ -51,11 +51,36 @@ function parseLimitEventFromTranscript(transcript) {
     }
     return found;
 }
+/**
+ * Codex's `rate_limit_reached_type` is exactly five values (read off the 0.154
+ * binary): `rate_limit_reached`, `workspace_{owner,member}_credits_depleted`
+ * and `workspace_{owner,member}_usage_limit_reached`.
+ *
+ * The split that matters to a reader of the dashboard is "someone must act on
+ * money" vs "this dev is throttled and it will reset" — so map on what the
+ * snapshot actually asserts, not on the word "credits":
+ *
+ * - A member out of their OWN allowance is a rate limit. Real snapshots carry
+ *   `spend_control_reached: null` and `individual_limit: null` — nobody
+ *   configured a budget, the window is simply used up. Calling that personal
+ *   spend tells a manager the dev overspent, which is not what happened.
+ *
+ *   Deliberately NOT gated on `individual_limit`: it has only ever been
+ *   observed null, so its populated shape and meaning are unknown, and a
+ *   wrong guess reinstates the mislabel this exists to remove. The reason
+ *   string is the causal signal; `individual_limit` is at best correlative.
+ * - A member whose ADMIN capped them (`usage_limit_reached`) is personal spend:
+ *   there really is a cap, and someone can raise it.
+ * - Anything owner-scoped is org spend — the org's allowance or credits are
+ *   gone and somebody has to act.
+ */
 function codexLimitKind(reason, spendControlReached) {
     if (spendControlReached || reason.startsWith("workspace_owner_"))
         return "org_spend";
-    if (reason.startsWith("workspace_member_"))
+    if (reason === "workspace_member_usage_limit_reached")
         return "user_spend";
+    if (reason === "workspace_member_credits_depleted")
+        return "session";
     return reason === "rate_limit_reached" ? "session" : "other";
 }
 function codexResetText(rateLimits) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.55",
+  "version": "0.9.56",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",